88 lines
2.8 KiB
Diff
88 lines
2.8 KiB
Diff
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Thu, 11 Apr 2024 13:28:59 +0200
|
|
Subject: [PATCH] netfilter: flowtable: validate pppoe header
|
|
|
|
Ensure there is sufficient room to access the protocol field of the
|
|
PPPoe header. Validate it once before the flowtable lookup, then use a
|
|
helper function to access protocol field.
|
|
|
|
Reported-by: syzbot+b6f07e1c07ef40199081@syzkaller.appspotmail.com
|
|
Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
---
|
|
|
|
--- a/include/net/netfilter/nf_flow_table.h
|
|
+++ b/include/net/netfilter/nf_flow_table.h
|
|
@@ -335,7 +335,7 @@ int nf_flow_rule_route_ipv6(struct net *
|
|
int nf_flow_table_offload_init(void);
|
|
void nf_flow_table_offload_exit(void);
|
|
|
|
-static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
|
|
+static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb)
|
|
{
|
|
__be16 proto;
|
|
|
|
@@ -351,6 +351,16 @@ static inline __be16 nf_flow_pppoe_proto
|
|
return 0;
|
|
}
|
|
|
|
+static inline bool nf_flow_pppoe_proto(struct sk_buff *skb, __be16 *inner_proto)
|
|
+{
|
|
+ if (!pskb_may_pull(skb, PPPOE_SES_HLEN))
|
|
+ return false;
|
|
+
|
|
+ *inner_proto = __nf_flow_pppoe_proto(skb);
|
|
+
|
|
+ return true;
|
|
+}
|
|
+
|
|
#define NF_FLOW_TABLE_STAT_INC(net, count) __this_cpu_inc((net)->ft.stat->count)
|
|
#define NF_FLOW_TABLE_STAT_DEC(net, count) __this_cpu_dec((net)->ft.stat->count)
|
|
#define NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count) \
|
|
--- a/net/netfilter/nf_flow_table_inet.c
|
|
+++ b/net/netfilter/nf_flow_table_inet.c
|
|
@@ -21,7 +21,8 @@ nf_flow_offload_inet_hook(void *priv, st
|
|
proto = veth->h_vlan_encapsulated_proto;
|
|
break;
|
|
case htons(ETH_P_PPP_SES):
|
|
- proto = nf_flow_pppoe_proto(skb);
|
|
+ if (!nf_flow_pppoe_proto(skb, &proto))
|
|
+ return NF_ACCEPT;
|
|
break;
|
|
default:
|
|
proto = skb->protocol;
|
|
--- a/net/netfilter/nf_flow_table_ip.c
|
|
+++ b/net/netfilter/nf_flow_table_ip.c
|
|
@@ -273,10 +273,11 @@ static unsigned int nf_flow_xmit_xfrm(st
|
|
return NF_STOLEN;
|
|
}
|
|
|
|
-static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
|
|
+static bool nf_flow_skb_encap_protocol(struct sk_buff *skb, __be16 proto,
|
|
u32 *offset)
|
|
{
|
|
struct vlan_ethhdr *veth;
|
|
+ __be16 inner_proto;
|
|
|
|
switch (skb->protocol) {
|
|
case htons(ETH_P_8021Q):
|
|
@@ -287,7 +288,8 @@ static bool nf_flow_skb_encap_protocol(c
|
|
}
|
|
break;
|
|
case htons(ETH_P_PPP_SES):
|
|
- if (nf_flow_pppoe_proto(skb) == proto) {
|
|
+ if (nf_flow_pppoe_proto(skb, &inner_proto) &&
|
|
+ inner_proto == proto) {
|
|
*offset += PPPOE_SES_HLEN;
|
|
return true;
|
|
}
|
|
@@ -316,7 +318,7 @@ static void nf_flow_encap_pop(struct sk_
|
|
skb_reset_network_header(skb);
|
|
break;
|
|
case htons(ETH_P_PPP_SES):
|
|
- skb->protocol = nf_flow_pppoe_proto(skb);
|
|
+ skb->protocol = __nf_flow_pppoe_proto(skb);
|
|
skb_pull(skb, PPPOE_SES_HLEN);
|
|
skb_reset_network_header(skb);
|
|
break;
|