Re: [PATCH nf] netfilter: nf_reject_ipv4: initialize IPCB at inet ingress

[Florian Westphal]

David Lee <david.lee@xxxxxxxxxxxxxxx> wrote:
> From: Kyle Zeng <kylebot@xxxxxxxxxx>
> 
> The inet ingress hook runs before ip_rcv_core(), so IPCB has not been
> initialized when nft_reject_inet passes an IPv4 packet to
> nf_send_unreach(). skb->cb can therefore retain data from an earlier
> protocol layer.
> 
> icmp_send() treats IPCB(skb)->opt as parsed IPv4 options. Stale option
> offsets can make __ip_options_echo() copy an attacker-controlled length
> into its 40-byte reply option buffer and overflow the stack.
> 
> Clear IPCB for NF_INET_INGRESS and restore its input interface, matching
> the initialization normally performed by ip_rcv_core().

Will you also send a patch for net/ipv6/netfilter/nf_reject_ipv6.c ?

Or: send a v2 that also fixes this up,
Or: send a v2 that mentions why net/ipv6/netfilter/nf_reject_ipv6.c is
fine (I doubt it).