mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find()
[ Upstream commit559c36c5a8
] nf_osf_find() incorrectly returns true on mismatch, this leads to copying uninitialized memory area in nft_osf which can be used to leak stale kernel stack data to userspace. Fixes:22c7652cda
("netfilter: nft_osf: Add version option support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
d0a24bc8e2
commit
721ea8ac06
1 changed files with 3 additions and 1 deletions
|
@ -269,6 +269,7 @@ bool nf_osf_find(const struct sk_buff *skb,
|
|||
struct nf_osf_hdr_ctx ctx;
|
||||
const struct tcphdr *tcp;
|
||||
struct tcphdr _tcph;
|
||||
bool found = false;
|
||||
|
||||
memset(&ctx, 0, sizeof(ctx));
|
||||
|
||||
|
@ -283,10 +284,11 @@ bool nf_osf_find(const struct sk_buff *skb,
|
|||
|
||||
data->genre = f->genre;
|
||||
data->version = f->version;
|
||||
found = true;
|
||||
break;
|
||||
}
|
||||
|
||||
return true;
|
||||
return found;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(nf_osf_find);
|
||||
|
||||
|
|
Loading…
Reference in a new issue