From nobody Fri Dec 19 07:16:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE885C6FA83 for ; Mon, 26 Sep 2022 10:26:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235255AbiIZK0x (ORCPT ); Mon, 26 Sep 2022 06:26:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34584 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235498AbiIZKYA (ORCPT ); Mon, 26 Sep 2022 06:24:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA87D4D27B; Mon, 26 Sep 2022 03:17:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8335860B4A; Mon, 26 Sep 2022 10:17:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 76375C433C1; Mon, 26 Sep 2022 10:17:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1664187438; bh=zLZzOUYjdWwXPgGurcuLAzv3SJsOlHaIku/dsI7zJYU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m7y90PXiFXIYFbjPJvlnIEuE69Xnt3a+FK4AqrDg9UIeWBWJ/J+xgNxFOkA7oG8Jy iDzS/o8wIJsDZ1LjtxAvqcpscpuB70bF9vGi4uRccwFPX03bDgQY4gYvtLcj/fIqnE YgZtEIuFjBPkdNrT9lk3/9mKGoZDyABGZz+mQvs4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Igor Ryzhov , Florian Westphal , Sasha Levin Subject: [PATCH 4.14 24/40] netfilter: nf_conntrack_sip: fix ct_sip_walk_headers Date: Mon, 26 Sep 2022 12:11:52 +0200 Message-Id: <20220926100739.192087067@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220926100738.148626940@linuxfoundation.org> References: <20220926100738.148626940@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Igor Ryzhov [ Upstream commit 39aebedeaaa95757f5c1f2ddb5f43fdddbf478ca ] ct_sip_next_header and ct_sip_get_header return an absolute value of matchoff, not a shift from current dataoff. So dataoff should be assigned matchoff, not incremented by it. This issue can be seen in the scenario when there are multiple Contact headers and the first one is using a hostname and other headers use IP addresses. In this case, ct_sip_walk_headers will work as follows: The first ct_sip_get_header call to will find the first Contact header but will return -1 as the header uses a hostname. But matchoff will be changed to the offset of this header. After that, dataoff should be set to matchoff, so that the next ct_sip_get_header call find the next Contact header. But instead of assigning dataoff to matchoff, it is incremented by it, which is not correct, as matchoff is an absolute value of the offset. So on the next call to the ct_sip_get_header, dataoff will be incorrect, and the next Contact header may not be found at all. Fixes: 05e3ced297fe ("[NETFILTER]: nf_conntrack_sip: introduce SIP-URI pars= ing helper") Signed-off-by: Igor Ryzhov Signed-off-by: Florian Westphal Signed-off-by: Sasha Levin --- net/netfilter/nf_conntrack_sip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_= sip.c index 4dbb5bad4363..3b4c9407d6f2 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -471,7 +471,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct= , const char *dptr, return ret; if (ret =3D=3D 0) break; - dataoff +=3D *matchoff; + dataoff =3D *matchoff; } *in_header =3D 0; } @@ -483,7 +483,7 @@ static int ct_sip_walk_headers(const struct nf_conn *ct= , const char *dptr, break; if (ret =3D=3D 0) return ret; - dataoff +=3D *matchoff; + dataoff =3D *matchoff; } =20 if (in_header) --=20 2.35.1