diff options
| author | David S. Miller <davem@davemloft.net> | 2018-07-09 14:55:54 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-07-09 14:55:54 -0700 |
| commit | 863f4fdb715c3328d4ff1ed547c5508c8e6e2b06 (patch) | |
| tree | ae65bea3d9a4e669d59c4a765cfdf007f7d0ee38 /include | |
| parent | c47078d6a33fd78d882200cdaacbcfcd63318234 (diff) | |
| parent | 9af86f9338949a9369bda5e6fed69347d1813054 (diff) | |
Merge branch 'fix-use-after-free-bugs-in-skb-list-processing'
Edward Cree says:
====================
fix use-after-free bugs in skb list processing
A couple of bugs in skb list handling were spotted by Dan Carpenter, with
the help of Smatch; following up on them I found a couple more similar
cases. This series fixes them by changing the relevant loops to use the
dequeue-enqueue model (rather than in-place list modification).
v3: fixed another similar bug in __netif_receive_skb_list_core().
v2: dropped patch #3 (new list.h helper), per DaveM's request.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/netfilter.h | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 5a5e0a2ab2a3..23b48de8c2e2 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -294,12 +294,16 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, int (*okfn)(struct net *, struct sock *, struct sk_buff *)) { struct sk_buff *skb, *next; + struct list_head sublist; + INIT_LIST_HEAD(&sublist); list_for_each_entry_safe(skb, next, head, list) { - int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn); - if (ret != 1) - list_del(&skb->list); + list_del(&skb->list); + if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) + list_add_tail(&skb->list, &sublist); } + /* Put passed packets back on main list */ + list_splice(&sublist, head); } /* Call setsockopt() */ |