Stephen Hemminger
2018-Apr-27 18:16 UTC
[Bridge] [PATCH net] bridge: netfilter stp fix reference to uninitialized data
The destination mac (destmac) is only valid if EBT_DESTMAC flag is set. Fix by changing the order of the comparison to look for the flag first. Reported-by: syzbot+5c06e318fc558cc27823 at syzkaller.appspotmail.com Signed-off-by: Stephen Hemminger <stephen at networkplumber.org> --- Note: no fixes since this bug goes back to pre-git days. Should go to stable as well. net/bridge/netfilter/ebt_stp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c index 47ba98db145d..46c1fe7637ea 100644 --- a/net/bridge/netfilter/ebt_stp.c +++ b/net/bridge/netfilter/ebt_stp.c @@ -161,8 +161,8 @@ static int ebt_stp_mt_check(const struct xt_mtchk_param *par) /* Make sure the match only receives stp frames */ if (!par->nft_compat && (!ether_addr_equal(e->destmac, eth_stp_addr) || - !is_broadcast_ether_addr(e->destmsk) || - !(e->bitmask & EBT_DESTMAC))) + !(e->bitmask & EBT_DESTMAC) || + !is_broadcast_ether_addr(e->destmsk))) return -EINVAL; return 0; -- 2.17.0
Pablo Neira Ayuso
2018-May-08 12:17 UTC
[Bridge] [PATCH net] bridge: netfilter stp fix reference to uninitialized data
On Fri, Apr 27, 2018 at 11:16:09AM -0700, Stephen Hemminger wrote:> The destination mac (destmac) is only valid if EBT_DESTMAC flag > is set. Fix by changing the order of the comparison to look for > the flag first.Applied, thanks Stephen.