Commit 67bf002a authored by Ruide Cao's avatar Ruide Cao Committed by Jakub Kicinski
Browse files

ipv4: icmp: validate reply type before using icmp_pointers 



Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
That value is outside the range covered by icmp_pointers[], which only
describes the traditional ICMP types up to NR_ICMP_TYPES.

Avoid consulting icmp_pointers[] for reply types outside that range, and
use array_index_nospec() for the remaining in-range lookup. Normal ICMP
replies keep their existing behavior unchanged.

Fixes: d329ea5b ("icmp: add response to RFC 8335 PROBE messages")
Cc: stable@kernel.org
Reported-by: default avatarYuan Tan <yuantan098@gmail.com>
Reported-by: default avatarYifan Wu <yifanwucs@gmail.com>
Reported-by: default avatarJuefei Pu <tomapufckgml@gmail.com>
Reported-by: default avatarXin Liu <bird@lzu.edu.cn>
Signed-off-by: default avatarRuide Cao <caoruide123@gmail.com>
Signed-off-by: default avatarRen Wei <n05ec@lzu.edu.cn>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://patch.msgid.link/0dace90c01a5978e829ca741ef684dbd7304ce62.1776628519.git.caoruide123@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 7ebc6504

net/ipv4/icmp.c

+4 −1
Original line number Diff line number Diff line
@@ -64,6 +64,7 @@ 
#include <linux/jiffies.h>

#include <linux/kernel.h>

#include <linux/fcntl.h>

#include <linux/nospec.h>

#include <linux/socket.h>

#include <linux/in.h>

#include <linux/inet.h>
@@ -371,7 +372,9 @@ static int icmp_glue_bits(void *from, char *to, int offset, int len, int odd, 
				      to, len);



	skb->csum = csum_block_add(skb->csum, csum, odd);

	if (icmp_pointers[icmp_param->data.icmph.type].error)

	if (icmp_param->data.icmph.type <= NR_ICMP_TYPES &&

	    icmp_pointers[array_index_nospec(icmp_param->data.icmph.type,

					     NR_ICMP_TYPES + 1)].error)

		nf_ct_attach(skb, icmp_param->skb);

	return 0;

}