From: Edward Cree <ecree@solarflare.com>
Date: Mon, 9 Jul 2018 18:10:02 +0100
Subject: netfilter: fix use-after-free in NF_HOOK_LIST
Patch-mainline: v4.19-rc1
Git-commit: 9f17dbf04ddf55ae48f5bbafea4c4920ea943215
References: bsc#1109837
nf_hook() can free the skb, so we need to remove it from the list before
calling, and add passed skbs to a sublist afterwards.
Fixes: 17266ee93984 ("net: ipv4: listified version of ip_rcv")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
include/linux/netfilter.h | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -264,12 +264,16 @@ NF_HOOK_LIST(uint8_t pf, unsigned int ho
int (*okfn)(struct net *, struct sock *, struct sk_buff *))
{
struct sk_buff *skb, *next;
+ struct list_head sublist;
+ INIT_LIST_HEAD(&sublist);
list_for_each_entry_safe(skb, next, head, list) {
- int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn);
- if (ret != 1)
- list_del(&skb->list);
+ list_del(&skb->list);
+ if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1)
+ list_add_tail(&skb->list, &sublist);
}
+ /* Put passed packets back on main list */
+ list_splice(&sublist, head);
}
/* Call setsockopt() */