| commit | ced7689be60ddcac4b1746212c547e8817c5ae5e | |
| author | Eric Dumazet <edumazet@google.com> | |
| Mon, 3 Apr 2017 17:55:11 +0000 (3 10:55 -0700) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Wed, 5 Jul 2017 12:40:16 +0000 (5 14:40 +0200) | ||
| tree | 02d5f21515054997702d8cf5bf090100b07b6194 | treesnapshot (tar.gz zip) |
| parent | 8e2316399b8faa87496886506f145ed988cf5c68 | commitdiff |
netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
commit 2638fd0f92d4397884fd991d8f4925cb3f081901 upstream.
Denys provided an awesome KASAN report pointing to an use
after free in xt_TCPMSS
I have provided three patches to fix this issue, either in xt_TCPMSS or
in xt_tcpudp.c. It seems xt_TCPMSS patch has the smallest possible
impact.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 2638fd0f92d4397884fd991d8f4925cb3f081901 upstream.
Denys provided an awesome KASAN report pointing to an use
after free in xt_TCPMSS
I have provided three patches to fix this issue, either in xt_TCPMSS or
in xt_tcpudp.c. It seems xt_TCPMSS patch has the smallest possible
impact.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Denys Fedoryshchenko <nuclearcat@nuclearcat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| net/netfilter/xt_TCPMSS.c | diffblobblamehistory |