• Willem de Bruijn's avatar
    net-timestamp: avoid use-after-free in ip_recv_error · 1862d620
    Willem de Bruijn authored
    Syzkaller reported a use-after-free in ip_recv_error at line
    
        info->ipi_ifindex = skb->dev->ifindex;
    
    This function is called on dequeue from the error queue, at which
    point the device pointer may no longer be valid.
    
    Save ifindex on enqueue in __skb_complete_tx_timestamp, when the
    pointer is valid or NULL. Store it in temporary storage skb->cb.
    
    It is safe to reference skb->dev here, as called from device drivers
    or dev_queue_xmit. The exception is when called from tcp_ack_tstamp;
    in that case it is NULL and ifindex is set to 0 (invalid).
    
    Do not return a pktinfo cmsg if ifindex is 0. This maintains the
    current behavior of not returning a cmsg if skb->dev was NULL.
    
    On dequeue, the ipv4 path will cast from sock_exterr_skb to
    in_pktinfo. Both have ifindex as their first element, so no explicit
    conversion is needed. This is by design, introduced in commit
    0b922b7a ("net: original ingress device index in PKTINFO"). For
    ipv6 ip6_datagram_support_cmsg converts to in6_pktinfo.
    
    Fixes: 829ae9d6 ("net-timestamp: allow reading recv cmsg on errqueue with origin tstamp")
    Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    1862d620
ip_sockglue.c 37.1 KB