Messages in this thread Patch in this message | | | From | Hillf Danton <> | Subject | Re: [syzbot] [net?] KASAN: use-after-free Read in __skb_flow_dissect (3) | Date | Thu, 18 Jan 2024 06:51:12 +0800 |
| |
On Mon, 01 Jan 2024 09:18:16 -0800 > syzbot found the following issue on: > > HEAD commit: f5837722ffec Merge tag 'mm-hotfixes-stable-2023-12-27-15-0.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=122dfc65e80000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
--- x/net/core/flow_dissector.c +++ y/net/core/flow_dissector.c @@ -1164,9 +1164,11 @@ proto_again: switch (proto) { case htons(ETH_P_IP): { const struct iphdr *iph; - struct iphdr _iph; - iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph); + if (pskb_network_may_pull(skb, sizeof(struct iphdr))) + iph = (void *) skb_network_header(skb); + else + iph = NULL; if (!iph || iph->ihl < 5) { fdret = FLOW_DISSECT_RET_OUT_BAD; break; --
| |