1
0
Fork 0
remarkable-linux/net/ipv6/netfilter
Florian Westphal 39f154faec netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
commit b078556aec upstream.

l4proto->manip_pkt() can cause reallocation of skb head so pointer
to the ipv6 header must be reloaded.

Reported-and-tested-by: <syzbot+10005f4292fc9cc89de7@syzkaller.appspotmail.com>
Fixes: 58a317f106 ("netfilter: ipv6: add IPv6 NAT support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-15 10:54:24 +01:00
..
Kconfig netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c 2016-11-01 20:50:31 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ip6_tables.c netfilter: add back stackpointer size checks 2018-03-15 10:54:23 +01:00
ip6t_MASQUERADE.c netfilter: x_tables: move hook state into xt_action_param structure 2016-11-03 10:56:21 +01:00
ip6t_NPT.c xtables: extend matches and targets with .usersize 2017-01-09 17:24:55 +01:00
ip6t_REJECT.c netfilter: x_tables: move hook state into xt_action_param structure 2016-11-03 10:56:21 +01:00
ip6t_SYNPROXY.c netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook 2017-10-09 13:08:39 +02:00
ip6t_ah.c netfilter: ip6_tables: add flags parameter to ipv6_find_hdr() 2012-05-09 12:53:47 +02:00
ip6t_eui64.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
ip6t_frag.c netfilter: ip6_tables: add flags parameter to ipv6_find_hdr() 2012-05-09 12:53:47 +02:00
ip6t_hbh.c netfilter: ip6_tables: add flags parameter to ipv6_find_hdr() 2012-05-09 12:53:47 +02:00
ip6t_ipv6header.c netfilter: remove unnecessary break after return 2014-07-15 16:27:00 -07:00
ip6t_mh.c netfilter: xtables: change hotdrop pointer to direct modification 2010-05-11 18:35:27 +02:00
ip6t_rpfilter.c netfilter: rpfilter: fix incorrect loopback packet judgment 2017-01-16 14:23:01 +01:00
ip6t_rt.c netfilter: ip6_tables: add flags parameter to ipv6_find_hdr() 2012-05-09 12:53:47 +02:00
ip6table_filter.c netfilter: xtables: don't hook tables by default 2016-03-02 20:05:24 +01:00
ip6table_mangle.c netfilter: x_tables: simplify ip{6}table_mangle_hook() 2016-07-01 16:37:02 +02:00
ip6table_nat.c netfilter: nf_hook_ops structs can be const 2017-07-31 19:10:44 +02:00
ip6table_raw.c netfilter: xtables: don't hook tables by default 2016-03-02 20:05:24 +01:00
ip6table_security.c netfilter: xtables: don't hook tables by default 2016-03-02 20:05:24 +01:00
nf_conntrack_l3proto_ipv6.c netfilter: on sockopt() acquire sock lock only in the required scope 2018-02-25 11:07:50 +01:00
nf_conntrack_proto_icmpv6.c net: Replace NF_CT_ASSERT() with WARN_ON(). 2017-09-04 13:25:19 +02:00
nf_conntrack_reasm.c Revert "net: fix percpu memory leaks" 2017-09-03 11:01:05 -07:00
nf_defrag_ipv6_hooks.c netfilter: nf_hook_ops structs can be const 2017-07-31 19:10:44 +02:00
nf_dup_ipv6.c netfilter: kill the fake untracked conntrack objects 2017-04-15 11:47:57 +02:00
nf_log_ipv6.c netfilter: constify nf_loginfo structures 2017-08-02 14:25:59 +02:00
nf_nat_l3proto_ipv6.c netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt 2018-03-15 10:54:24 +01:00
nf_nat_masquerade_ipv6.c net: Replace NF_CT_ASSERT() with WARN_ON(). 2017-09-04 13:25:19 +02:00
nf_nat_proto_icmpv6.c net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool 2015-08-17 21:33:06 -07:00
nf_reject_ipv6.c networking: make skb_put & friends return void pointers 2017-06-16 11:48:39 -04:00
nf_socket_ipv6.c netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c 2016-11-01 20:50:31 +01:00
nf_tables_ipv6.c netfilter: Add the missed return value check of nft_register_chain_type 2016-09-12 19:54:45 +02:00
nft_chain_nat_ipv6.c netfilter: Pass priv instead of nf_hook_ops to netfilter hooks 2015-09-18 22:00:16 +02:00
nft_chain_route_ipv6.c Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-09-25 23:34:19 +02:00
nft_dup_ipv6.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-11-15 10:54:36 -05:00
nft_fib_ipv6.c netfilter: nf_tables: fib: use skb_header_pointer 2017-07-31 19:01:39 +02:00
nft_masq_ipv6.c netfilter: nf_tables: fix mismatch in big-endian system 2017-03-13 13:30:28 +01:00
nft_redir_ipv6.c netfilter: nf_tables: fix mismatch in big-endian system 2017-03-13 13:30:28 +01:00
nft_reject_ipv6.c netfilter: nf_tables: use hook state from xt_action_param structure 2016-11-03 11:52:34 +01:00