On Mon, Apr 19, 2021 at 8:24 AM Davide Caratti <dcara...@redhat.com> wrote: > > when 'act_mirred' tries to fragment IPv4 packets that had been previously > re-assembled using 'act_ct', splats like the following can be observed on > kernels built with KASAN: [...] > for IPv4 packets, sch_fragment() uses a temporary struct dst_entry. Then, > in the following call graph: > > ip_do_fragment() > ip_skb_dst_mtu() > ip_dst_mtu_maybe_forward() > ip_mtu_locked() > > the pointer to struct dst_entry is used as pointer to struct rtable: this > turns the access to struct members like rt_mtu_locked into an OOB read in > the stack. Fix this changing the temporary variable used for IPv4 packets > in sch_fragment(), similarly to what is done for IPv6 few lines below. > > Fixes: c129412f74e9 ("net/sched: sch_frag: add generic packet fragment > support.") > Cc: <sta...@vger.kernel.org> # 5.11 > Reported-by: Shuang Li <shu...@redhat.com> > Signed-off-by: Davide Caratti <dcara...@redhat.com>
Acked-by: Cong Wang <cong.w...@bytedance.com> Thanks.