diff options
| author |   Steffen Klassert <steffen.klassert@secunet.com> | 2018-11-22 07:26:24 +0100 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2018-11-22 10:09:39 +0100 |
| commit | 0152eee6fc3b84298bb6a79961961734e8afa5b8 (patch) | |
| tree | 0c97d1dc87bf2b54971bf0b215ddbd5a837a9fb5 /net/xfrm/xfrm_user.c | |
| parent | xfrm: Fix bucket count reported to userspace (diff) | |
| download | linux-dev-0152eee6fc3b84298bb6a79961961734e8afa5b8.tar.xz linux-dev-0152eee6fc3b84298bb6a79961961734e8afa5b8.zip | |
xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.
Since commit 222d7dbd258d ("net: prevent dst uses after free")
skb_dst_force() might clear the dst_entry attached to the skb.
The xfrm code doesn't expect this to happen, so we crash with
a NULL pointer dereference in this case.
Fix it by checking skb_dst(skb) for NULL after skb_dst_force()
and drop the packet in case the dst_entry was cleared. We also
move the skb_dst_force() to a codepath that is not used when
the transformation was offloaded, because in this case we
don't have a dst_entry attached to the skb.
The output and forwarding path was already fixed by
commit 9e1437937807 ("xfrm: Fix NULL pointer dereference when
skb_dst_force clears the dst_entry.")
Fixes: 222d7dbd258d ("net: prevent dst uses after free")
Reported-by: Jean-Philippe Menil <jpmenil@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions