queue-4.14/xfrm-fix-null-pointer-dereference-in-xfrm_input-when.patch

   1 From 0e0ad41a64aecf360c44eb2bb7ce29653b37f992 Mon Sep 17 00:00:00 2001
   2 From: Steffen Klassert <steffen.klassert@secunet.com>
   3 Date: Thu, 22 Nov 2018 07:26:24 +0100
   4 Subject: xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force
   5  clears the dst_entry.
   6
   7 [ Upstream commit 0152eee6fc3b84298bb6a79961961734e8afa5b8 ]
   8
   9 Since commit 222d7dbd258d ("net: prevent dst uses after free")
  10 skb_dst_force() might clear the dst_entry attached to the skb.
  11 The xfrm code doesn't expect this to happen, so we crash with
  12 a NULL pointer dereference in this case.
  13
  14 Fix it by checking skb_dst(skb) for NULL after skb_dst_force()
  15 and drop the packet in case the dst_entry was cleared. We also
  16 move the skb_dst_force() to a codepath that is not used when
  17 the transformation was offloaded, because in this case we
  18 don't have a dst_entry attached to the skb.
  19
  20 The output and forwarding path was already fixed by
  21 commit 9e1437937807 ("xfrm: Fix NULL pointer dereference when
  22 skb_dst_force clears the dst_entry.")
  23
  24 Fixes: 222d7dbd258d ("net: prevent dst uses after free")
  25 Reported-by: Jean-Philippe Menil <jpmenil@gmail.com>
  26 Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
  27 Signed-off-by: Sasha Levin <sashal@kernel.org>
  28 ---
  29  net/xfrm/xfrm_input.c | 7 ++++++-
  30  1 file changed, 6 insertions(+), 1 deletion(-)
  31
  32 diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
  33 index 8e75319dd9c0..06dec32503bd 100644
  34 --- a/net/xfrm/xfrm_input.c
  35 +++ b/net/xfrm/xfrm_input.c
  36 @@ -341,6 +341,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
  37
  38                 skb->sp->xvec[skb->sp->len++] = x;
  39
  40 +               skb_dst_force(skb);
  41 +               if (!skb_dst(skb)) {
  42 +                       XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
  43 +                       goto drop;
  44 +               }
  45 +
  46  lock:
  47                 spin_lock(&x->lock);
  48
  49 @@ -380,7 +386,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
  50                 XFRM_SKB_CB(skb)->seq.input.low = seq;
  51                 XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
  52
  53 -               skb_dst_force(skb);
  54                 dev_hold(skb->dev);
  55
  56                 if (crypto_done)
  57 --
  58 2.19.1
  59