queue-5.0/net-fou-do-not-use-guehdr-after-iptunnel_pull_offloads-in-gue_udp_recv.patch

   1 From foo@baz Sat Apr 20 16:43:09 CEST 2019
   2 From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
   3 Date: Tue, 9 Apr 2019 11:47:20 +0200
   4 Subject: net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
   5
   6 From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
   7
   8 [ Upstream commit 988dc4a9a3b66be75b30405a5494faf0dc7cffb6 ]
   9
  10 gue tunnels run iptunnel_pull_offloads on received skbs. This can
  11 determine a possible use-after-free accessing guehdr pointer since
  12 the packet will be 'uncloned' running pskb_expand_head if it is a
  13 cloned gso skb (e.g if the packet has been sent though a veth device)
  14
  15 Fixes: a09a4c8dd1ec ("tunnels: Remove encapsulation offloads on decap")
  16 Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
  17 Signed-off-by: David S. Miller <davem@davemloft.net>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19 ---
  20  net/ipv4/fou.c |    4 +++-
  21  1 file changed, 3 insertions(+), 1 deletion(-)
  22
  23 --- a/net/ipv4/fou.c
  24 +++ b/net/ipv4/fou.c
  25 @@ -121,6 +121,7 @@ static int gue_udp_recv(struct sock *sk,
  26         struct guehdr *guehdr;
  27         void *data;
  28         u16 doffset = 0;
  29 +       u8 proto_ctype;
  30
  31         if (!fou)
  32                 return 1;
  33 @@ -212,13 +213,14 @@ static int gue_udp_recv(struct sock *sk,
  34         if (unlikely(guehdr->control))
  35                 return gue_control_message(skb, guehdr);
  36
  37 +       proto_ctype = guehdr->proto_ctype;
  38         __skb_pull(skb, sizeof(struct udphdr) + hdrlen);
  39         skb_reset_transport_header(skb);
  40
  41         if (iptunnel_pull_offloads(skb))
  42                 goto drop;
  43
  44 -       return -guehdr->proto_ctype;
  45 +       return -proto_ctype;
  46
  47  drop:
  48         kfree_skb(skb);