From: Pablo Neira Ayuso Date: Wed, 30 Oct 2024 22:13:48 +0000 (+0100) Subject: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() X-Git-Tag: v6.12-rc6~33^2^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d5953d680f7e96208c29ce4139a0e38de87a57fe;p=thirdparty%2Flinux.git netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed. Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support") Reported-by: Slavin Liu Signed-off-by: Pablo Neira Ayuso --- diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c index 330609a76fb20..7dfc5343dae46 100644 --- a/net/netfilter/nft_payload.c +++ b/net/netfilter/nft_payload.c @@ -904,6 +904,9 @@ static void nft_payload_set_eval(const struct nft_expr *expr, ((priv->base != NFT_PAYLOAD_TRANSPORT_HEADER && priv->base != NFT_PAYLOAD_INNER_HEADER) || skb->ip_summed != CHECKSUM_PARTIAL)) { + if (offset + priv->len > skb->len) + goto err; + fsum = skb_checksum(skb, offset, priv->len, 0); tsum = csum_partial(src, priv->len, 0);