From: Zixuan Chai <[email protected]>
i40e_atr() uses ipv6_find_hdr() to locate the TCP header. A successful
protocol match does not verify that the complete TCP header is present in
the skb, so dereferencing the result can access data beyond the packet.
Check that the complete TCP header is available before inspecting it.
Fixes: fd0a05ce74ef ("i40e: transmit, receive, and NAPI")
Cc: [email protected]
Reported-by: Florian Westphal <[email protected]>
Closes: https://lore.kernel.org/netfilter-devel/[email protected]/
Assisted-by: LLM
Signed-off-by: Zixuan Chai <[email protected]>
Signed-off-by: Ren Wei <[email protected]>
---
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index ef5e657816f0..cdac279b8aed 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -2911,6 +2911,9 @@ static void i40e_atr(struct i40e_ring *tx_ring, struct
sk_buff *skb,
if (l4_proto != IPPROTO_TCP)
return;
+ if (unlikely(skb_tail_pointer(skb) < hdr.network + hlen +
+ sizeof(struct tcphdr)))
+ return;
th = (struct tcphdr *)(hdr.network + hlen);
--
2.34.1
