ipv4: keep skb->dst around in presence of IP options

Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst is accessed. ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options are present. We could refine the test to the presence of ts_needtime or srr, but IP options are not often used, so let's be conservative. Thanks to syzkaller team for finding this bug. Upstream commit: 34b2cef20f19c87999fff3da4071e66937db9644 Fixes: d826eb1 ("ipv4: PKTINFO doesnt need dst reference") Bug: 35805460 Signed-off-by: Eric Dumazet <[email protected]> Reported-by: Andrey Konovalov <[email protected]> Signed-off-by: David S. Miller <[email protected]> Change-Id: I4428212665ba44b6f4a3d5999bcd8409a79bea04 Signed-off-by: Francisco Franco <[email protected]>
franciscofranco · Dec 9, 2017 · 8652a2b · 8652a2b
1 parent 4d73956
commit 8652a2b
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
@@ -1030,7 +1030,14 @@ void ipv4_pktinfo_prepare(struct sk_buff *skb)
 		pktinfo->ipi_ifindex = 0;
 		pktinfo->ipi_spec_dst.s_addr = 0;
 	}
-	skb_dst_drop(skb);
+	/* We need to keep the dst for __ip_options_echo()
+	 * We could restrict the test to opt.ts_needtime || opt.srr,
+	 * but the following is good enough as IP options are not often used.
+	 */
+	if (unlikely(IPCB(skb)->opt.optlen))
+		skb_dst_force(skb);
+	else
+		skb_dst_drop(skb);
 }
 
 int ip_setsockopt(struct sock *sk, int level,