netdev - [PATCH net-next 4/4] net: tcp: reset skb drop reason to NOT_SPCIFIED in tcp_v4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220512062629.10286-5-imagedong@tencent.com>
Date:   Thu, 12 May 2022 14:26:29 +0800
From:   menglong8.dong@...il.com
To:     kuba@...nel.org
Cc:     nhorman@...driver.com, davem@...emloft.net, edumazet@...gle.com,
        pabeni@...hat.com, yoshfuji@...ux-ipv6.org, dsahern@...nel.org,
        imagedong@...cent.com, kafai@...com, talalahmad@...gle.com,
        keescook@...omium.org, asml.silence@...il.com, willemb@...gle.com,
        vasily.averin@...ux.dev, ilias.apalodimas@...aro.org,
        luiz.von.dentz@...el.com, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: [PATCH net-next 4/4] net: tcp: reset skb drop reason to NOT_SPCIFIED in tcp_v4_rcv()

From: Menglong Dong <imagedong@...cent.com>

The 'drop_reason' that passed to kfree_skb_reason() in tcp_v4_rcv()
can be SKB_NOT_DROPPED_YET(0), as it is used as the return value of
tcp_inbound_md5_hash().

And it can panic the kernel with NULL pointer in
net_dm_packet_report_size() if the reason is 0, as drop_reasons[0]
is NULL.

Fixes: 1330b6ef3313 ("skb: make drop reason booleanable")

Signed-off-by: Menglong Dong <imagedong@...cent.com>
---
 net/ipv4/tcp_ipv4.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 918816ec5dd4..24eb42497a71 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2101,6 +2101,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
 	}
 
 discard_it:
+	SKB_DR_OR(drop_reason, NOT_SPECIFIED);
 	/* Discard frame. */
 	kfree_skb_reason(skb, drop_reason);
 	return 0;
-- 
2.36.1