diff options
| author | Samuel Moelius <sam.moelius@trailofbits.com> | 2026-06-09 18:56:34 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-06-12 15:16:10 -0700 |
| commit | d504a978572202ef43ac5ecfec2030adda64b13e (patch) | |
| tree | d754c364c16629ae92c829f16afc8a62ac5db85c /net | |
| parent | f6033078a9e671e3c8b83d387b91591a6f6a54e7 (diff) | |
net/sched: act_pedit: require matching IPv4 L4 protocol
The extended IPv4 L4 header mode in act_pedit can select TCP or UDP
header fields without confirming that the IPv4 protocol field matches
the selected transport header.
That lets a rule written for TCP or UDP modify unrelated payload bytes
in a packet carrying a different protocol.
Verify that the IPv4 header is long enough, that the protocol matches
the selected TCP or UDP header, and that the packet is not a non-initial
fragment before applying TCP or UDP extended header edits.
Cc: stable+noautosel@kernel.org # in real rule sets the match confirms this before calling the action
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/act_pedit.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c index bd3b1da3cd63..0d652dea4a69 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c @@ -18,6 +18,7 @@ #include <linux/slab.h> #include <linux/overflow.h> #include <linux/unaligned.h> +#include <net/ip.h> #include <net/ipv6.h> #include <net/netlink.h> #include <net/pkt_sched.h> @@ -331,6 +332,9 @@ static int pedit_l4_skb_offset(struct sk_buff *skb, int *hoffset, const int head if (!iph) goto out; + if (iph->ihl < 5 || iph->protocol != header_type || + (iph->frag_off & htons(IP_OFFSET))) + goto out; *hoffset = noff + iph->ihl * 4; ret = 0; break; |