]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: synproxy: fix BUG_ON triggered by corrupt TCP packets
authorPatrick McHardy <kaber@trash.net>
Mon, 30 Sep 2013 07:51:46 +0000 (08:51 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 30 Sep 2013 10:44:38 +0000 (12:44 +0200)
commitc6cf576612af666b9dbc10c74182816e48bb0e04
tree72359689d53c3ce656b4568f04b8ee92dd2e05f4
parent881903280c82993f63fc0eb5bb1e6a8a63688e1c
netfilter: synproxy: fix BUG_ON triggered by corrupt TCP packets

TCP packets hitting the SYN proxy through the SYNPROXY target are not
validated by TCP conntrack. When th->doff is below 5, an underflow happens
when calculating the options length, causing skb_header_pointer() to
return NULL and triggering the BUG_ON().

Handle this case gracefully by checking for NULL instead of using BUG_ON().

Reported-by: Martin Topholm <mph@one.com>
Tested-by: Martin Topholm <mph@one.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/nf_conntrack_synproxy.h
net/ipv4/netfilter/ipt_SYNPROXY.c
net/ipv6/netfilter/ip6t_SYNPROXY.c
net/netfilter/nf_synproxy_core.c