diff options
| author | Patrick McHardy <kaber@trash.net> | 2013-09-30 08:51:46 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-09-30 12:44:38 +0200 |
| commit | f4a87e7bd2eaef26a3ca25437ce8b807de2966ad (patch) | |
| tree | 72359689d53c3ce656b4568f04b8ee92dd2e05f4 /kernel/user-return-notifier.c | |
| parent | d1ee4fea0b6946dd8bc61b46db35ea80af7af34b (diff) | |
| download | linux-stable-f4a87e7bd2eaef26a3ca25437ce8b807de2966ad.tar.gz linux-stable-f4a87e7bd2eaef26a3ca25437ce8b807de2966ad.tar.bz2 linux-stable-f4a87e7bd2eaef26a3ca25437ce8b807de2966ad.zip | |
netfilter: synproxy: fix BUG_ON triggered by corrupt TCP packets
TCP packets hitting the SYN proxy through the SYNPROXY target are not
validated by TCP conntrack. When th->doff is below 5, an underflow happens
when calculating the options length, causing skb_header_pointer() to
return NULL and triggering the BUG_ON().
Handle this case gracefully by checking for NULL instead of using BUG_ON().
Reported-by: Martin Topholm <mph@one.com>
Tested-by: Martin Topholm <mph@one.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'kernel/user-return-notifier.c')
0 files changed, 0 insertions, 0 deletions