From: bluhm <bluhm@openbsd.org>
Date: Mon, 23 May 2022 11:17:35 +0000 (+0000)
Subject: In pf the kernel paniced if IP options in packet within ICMP payload
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=0271abd8e4942e853c0fc03b1a76e617f0d9a984;p=openbsd

In pf the kernel paniced if IP options in packet within ICMP payload
were truncated.  Drop such packets instead.
Reported-by: syzbot+91abd3aa2fdfe900f9ce@syzkaller.appspotmail.com
OK sashan@ claudio@
---

diff --git a/sys/net/pf.c b/sys/net/pf.c
index 0d1dbbdbd22..93fe5702625 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.1131 2022/05/23 09:54:18 bluhm Exp $ */
+/*	$OpenBSD: pf.c,v 1.1132 2022/05/23 11:17:35 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -6384,6 +6384,13 @@ pf_walk_option(struct pf_pdesc *pd, struct ip *h, int off, int end,
 {
 	uint8_t	type, length, opts[15 * 4 - sizeof(struct ip)];
 
+	/* IP header in payload of ICMP packet may be too short */
+	if (pd->m->m_pkthdr.len < end) {
+		DPFPRINTF(LOG_NOTICE, "IP option too short");
+		REASON_SET(reason, PFRES_SHORT);
+		return (PF_DROP);
+	}
+
 	KASSERT(end - off <= sizeof(opts));
 	m_copydata(pd->m, off, end - off, opts);
 	end -= off;