diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-10-31 01:13:48 +0300 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-10-31 12:54:49 +0300 |
| commit | d5953d680f7e96208c29ce4139a0e38de87a57fe (patch) | |
| tree | c3e9ec33ebe8be0458955dd11d414d2bb129f1f8 /tools/perf/scripts/python | |
| parent | 4ed234fe793f27a3b151c43d2106df2ff0d81aac (diff) | |
| download | linux-d5953d680f7e96208c29ce4139a0e38de87a57fe.tar.xz | |
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
If access to offset + length is larger than the skbuff length, then
skb_checksum() triggers BUG_ON().
skb_checksum() internally subtracts the length parameter while iterating
over skbuff, BUG_ON(len) at the end of it checks that the expected
length to be included in the checksum calculation is fully consumed.
Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support")
Reported-by: Slavin Liu <slavin-ayu@qq.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions