summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorZiyang Xuan <william.xuanziyang@huawei.com>2023-04-20 20:40:35 +0800
committerDavid S. Miller <davem@davemloft.net>2023-04-22 14:10:39 +0100
commit99e5acae193e369b71217efe6f1dad42f3f18815 (patch)
tree4828ad5ceece8950a4e12ba57a0667f1d4a2b0d0 /net
parent6e79bd28ab0abd7e82d020d6d1728c3ca543450f (diff)
downloadlinux-stable-99e5acae193e369b71217efe6f1dad42f3f18815.tar.gz
linux-stable-99e5acae193e369b71217efe6f1dad42f3f18815.tar.bz2
linux-stable-99e5acae193e369b71217efe6f1dad42f3f18815.zip
ipv4: Fix potential uninit variable access bug in __ip_make_skb()
Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()"). icmphdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will trigger the uninit variable access bug. Use a local variable icmp_type to carry the correct value in different scenarios. Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)") Reviewed-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/ip_output.c16
1 files changed, 13 insertions, 3 deletions
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 4e4e308c3230..89bd7872c629 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1570,9 +1570,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
cork->dst = NULL;
skb_dst_set(skb, &rt->dst);
- if (iph->protocol == IPPROTO_ICMP)
- icmp_out_count(net, ((struct icmphdr *)
- skb_transport_header(skb))->type);
+ if (iph->protocol == IPPROTO_ICMP) {
+ u8 icmp_type;
+
+ /* For such sockets, transhdrlen is zero when do ip_append_data(),
+ * so icmphdr does not in skb linear region and can not get icmp_type
+ * by icmp_hdr(skb)->type.
+ */
+ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl)
+ icmp_type = fl4->fl4_icmp_type;
+ else
+ icmp_type = icmp_hdr(skb)->type;
+ icmp_out_count(net, icmp_type);
+ }
ip_cork_release(cork);
out: