ipv4: Fix potential uninit variable access bug in __ip_make_skb()

[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ]

Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in
__ip6_make_skb()"). icmphdr does not in skb linear region under the
scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will
trigger the uninit variable access bug.

Use a local variable icmp_type to carry the correct value in different
scenarios.

Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)")
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 922c87ef1ab588205edda64fe09c2d7d460e67db..2a07588265c701ffc0e3bffdc3b4b5d67dd37d06 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1570,9 +1570,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
        cork->dst = NULL;
        skb_dst_set(skb, &rt->dst);
 
-       if (iph->protocol == IPPROTO_ICMP)
-               icmp_out_count(net, ((struct icmphdr *)
-                       skb_transport_header(skb))->type);
+       if (iph->protocol == IPPROTO_ICMP) {
+               u8 icmp_type;
+
+               /* For such sockets, transhdrlen is zero when do ip_append_data(),
+                * so icmphdr does not in skb linear region and can not get icmp_type
+                * by icmp_hdr(skb)->type.
+                */
+               if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl)
+                       icmp_type = fl4->fl4_icmp_type;
+               else
+                       icmp_type = icmp_hdr(skb)->type;
+               icmp_out_count(net, icmp_type);
+       }
 
        ip_cork_release(cork);
 out: