| Message ID | 20230420124035.2061588-1-william.xuanziyang@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 99e5acae193e369b71217efe6f1dad42f3f18815 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v3] ipv4: Fix potential uninit variable access bug in __ip_make_skb() | expand |
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Thu, 20 Apr 2023 20:40:35 +0800 you wrote: > Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in > __ip6_make_skb()"). icmphdr does not in skb linear region under the > scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will > trigger the uninit variable access bug. > > Use a local variable icmp_type to carry the correct value in different > scenarios. > > [...] Here is the summary with links: - [net,v3] ipv4: Fix potential uninit variable access bug in __ip_make_skb() https://git.kernel.org/netdev/net/c/99e5acae193e You are awesome, thank you!
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 4e4e308c3230..89bd7872c629 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1570,9 +1570,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk, cork->dst = NULL; skb_dst_set(skb, &rt->dst); - if (iph->protocol == IPPROTO_ICMP) - icmp_out_count(net, ((struct icmphdr *) - skb_transport_header(skb))->type); + if (iph->protocol == IPPROTO_ICMP) { + u8 icmp_type; + + /* For such sockets, transhdrlen is zero when do ip_append_data(), + * so icmphdr does not in skb linear region and can not get icmp_type + * by icmp_hdr(skb)->type. + */ + if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) + icmp_type = fl4->fl4_icmp_type; + else + icmp_type = icmp_hdr(skb)->type; + icmp_out_count(net, icmp_type); + } ip_cork_release(cork); out:
Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()"). icmphdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will trigger the uninit variable access bug. Use a local variable icmp_type to carry the correct value in different scenarios. Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)") Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> --- v3: - Fix misspell from "buf" to "bug". - Add comments for changes. - Add Reviewed-by tag. v2: - Use sk->sk_type not sk->sk_socket->type. --- net/ipv4/ip_output.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)