Taehee Yoo
4ef360dd6a
netfilter: nft_set: fix allocation size overflow in privsize callback.
In order to determine allocation size of set, ->privsize is invoked.
At this point, both desc->size and size of each data structure of set
are used. desc->size means number of element that is given by user.
desc->size is u32 type. so that upperlimit of set element is 4294967295.
but return type of ->privsize is also u32. hence overflow can occurred.
test commands:
%nft add table ip filter
%nft add set ip filter hash1 { type ipv4_addr \; size 4294967295 \; }
%nft list ruleset
splat looks like:
[ 1239.202910] kasan: CONFIG_KASAN_INLINE enabled
[ 1239.208788] kasan: GPF could be caused by NULL-ptr deref or user memory access
[ 1239.217625] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 1239.219329] CPU: 0 PID: 1603 Comm: nft Not tainted 4.18.0-rc5+ #7
[ 1239.229091] RIP: 0010:nft_hash_walk+0x1d2/0x310 [nf_tables_set]
[ 1239.229091] Code: 84 d2 7f 10 4c 89 e7 89 44 24 38 e8 d8 5a 17 e0 8b 44 24 38 48 8d 7b 10 41 0f b6 0c 24 48 89 fa 48 89 fe 48 c1 ea 03 83 e6 07 <42> 0f b6 14 3a 40 38 f2 7f 1a 84 d2 74 16
[ 1239.229091] RSP: 0018:ffff8801118cf358 EFLAGS: 00010246
[ 1239.229091] RAX: 0000000000000000 RBX: 0000000000020400 RCX: 0000000000000001
[ 1239.229091] RDX: 0000000000004082 RSI: 0000000000000000 RDI: 0000000000020410
[ 1239.229091] RBP: ffff880114d5a988 R08: 0000000000007e94 R09: ffff880114dd8030
[ 1239.229091] R10: ffff880114d5a988 R11: ffffed00229bb006 R12: ffff8801118cf4d0
[ 1239.229091] R13: ffff8801118cf4d8 R14: 0000000000000000 R15: dffffc0000000000
[ 1239.229091] FS: 00007f5a8fe0b700(0000) GS:ffff88011b600000(0000) knlGS:0000000000000000
[ 1239.229091] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1239.229091] CR2: 00007f5a8ecc27b0 CR3: 000000010608e000 CR4: 00000000001006f0
[ 1239.229091] Call Trace:
[ 1239.229091] ? nft_hash_remove+0xf0/0xf0 [nf_tables_set]
[ 1239.229091] ? memset+0x1f/0x40
[ 1239.229091] ? __nla_reserve+0x9f/0xb0
[ 1239.229091] ? memcpy+0x34/0x50
[ 1239.229091] nf_tables_dump_set+0x9a1/0xda0 [nf_tables]
[ 1239.229091] ? __kmalloc_reserve.isra.29+0x2e/0xa0
[ 1239.229091] ? nft_chain_hash_obj+0x630/0x630 [nf_tables]
[ 1239.229091] ? nf_tables_commit+0x2c60/0x2c60 [nf_tables]
[ 1239.229091] netlink_dump+0x470/0xa20
[ 1239.229091] __netlink_dump_start+0x5ae/0x690
[ 1239.229091] nft_netlink_dump_start_rcu+0xd1/0x160 [nf_tables]
[ 1239.229091] nf_tables_getsetelem+0x2e5/0x4b0 [nf_tables]
[ 1239.229091] ? nft_get_set_elem+0x440/0x440 [nf_tables]
[ 1239.229091] ? nft_chain_hash_obj+0x630/0x630 [nf_tables]
[ 1239.229091] ? nf_tables_dump_obj_done+0x70/0x70 [nf_tables]
[ 1239.229091] ? nla_parse+0xab/0x230
[ 1239.229091] ? nft_get_set_elem+0x440/0x440 [nf_tables]
[ 1239.229091] nfnetlink_rcv_msg+0x7f0/0xab0 [nfnetlink]
[ 1239.229091] ? nfnetlink_bind+0x1d0/0x1d0 [nfnetlink]
[ 1239.229091] ? debug_show_all_locks+0x290/0x290
[ 1239.229091] ? sched_clock_cpu+0x132/0x170
[ 1239.229091] ? find_held_lock+0x39/0x1b0
[ 1239.229091] ? sched_clock_local+0x10d/0x130
[ 1239.229091] netlink_rcv_skb+0x211/0x320
[ 1239.229091] ? nfnetlink_bind+0x1d0/0x1d0 [nfnetlink]
[ 1239.229091] ? netlink_ack+0x7b0/0x7b0
[ 1239.229091] ? ns_capable_common+0x6e/0x110
[ 1239.229091] nfnetlink_rcv+0x2d1/0x310 [nfnetlink]
[ 1239.229091] ? nfnetlink_rcv_batch+0x10f0/0x10f0 [nfnetlink]
[ 1239.229091] ? netlink_deliver_tap+0x829/0x930
[ 1239.229091] ? lock_acquire+0x265/0x2e0
[ 1239.229091] netlink_unicast+0x406/0x520
[ 1239.509725] ? netlink_attachskb+0x5b0/0x5b0
[ 1239.509725] ? find_held_lock+0x39/0x1b0
[ 1239.509725] netlink_sendmsg+0x987/0xa20
[ 1239.509725] ? netlink_unicast+0x520/0x520
[ 1239.509725] ? _copy_from_user+0xa9/0xc0
[ 1239.509725] __sys_sendto+0x21a/0x2c0
[ 1239.509725] ? __ia32_sys_getpeername+0xa0/0xa0
[ 1239.509725] ? retint_kernel+0x10/0x10
[ 1239.509725] ? sched_clock_cpu+0x132/0x170
[ 1239.509725] ? find_held_lock+0x39/0x1b0
[ 1239.509725] ? lock_downgrade+0x540/0x540
[ 1239.509725] ? up_read+0x1c/0x100
[ 1239.509725] ? __do_page_fault+0x763/0x970
[ 1239.509725] ? retint_user+0x18/0x18
[ 1239.509725] __x64_sys_sendto+0x177/0x180
[ 1239.509725] do_syscall_64+0xaa/0x360
[ 1239.509725] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1239.509725] RIP: 0033:0x7f5a8f468e03
[ 1239.509725] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb d0 0f 1f 84 00 00 00 00 00 83 3d 49 c9 2b 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8
[ 1239.509725] RSP: 002b:00007ffd78d0b778 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 1239.509725] RAX: ffffffffffffffda RBX: 00007ffd78d0c890 RCX: 00007f5a8f468e03
[ 1239.509725] RDX: 0000000000000034 RSI: 00007ffd78d0b7e0 RDI: 0000000000000003
[ 1239.509725] RBP: 00007ffd78d0b7d0 R08: 00007f5a8f15c160 R09: 000000000000000c
[ 1239.509725] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd78d0b7e0
[ 1239.509725] R13: 0000000000000034 R14: 00007f5a8f9aff60 R15: 00005648040094b0
[ 1239.509725] Modules linked in: nf_tables_set nf_tables nfnetlink ip_tables x_tables
[ 1239.670713] ---[ end trace 39375adcda140f11 ]---
[ 1239.676016] RIP: 0010:nft_hash_walk+0x1d2/0x310 [nf_tables_set]
[ 1239.682834] Code: 84 d2 7f 10 4c 89 e7 89 44 24 38 e8 d8 5a 17 e0 8b 44 24 38 48 8d 7b 10 41 0f b6 0c 24 48 89 fa 48 89 fe 48 c1 ea 03 83 e6 07 <42> 0f b6 14 3a 40 38 f2 7f 1a 84 d2 74 16
[ 1239.705108] RSP: 0018:ffff8801118cf358 EFLAGS: 00010246
[ 1239.711115] RAX: 0000000000000000 RBX: 0000000000020400 RCX: 0000000000000001
[ 1239.719269] RDX: 0000000000004082 RSI: 0000000000000000 RDI: 0000000000020410
[ 1239.727401] RBP: ffff880114d5a988 R08: 0000000000007e94 R09: ffff880114dd8030
[ 1239.735530] R10: ffff880114d5a988 R11: ffffed00229bb006 R12: ffff8801118cf4d0
[ 1239.743658] R13: ffff8801118cf4d8 R14: 0000000000000000 R15: dffffc0000000000
[ 1239.751785] FS: 00007f5a8fe0b700(0000) GS:ffff88011b600000(0000) knlGS:0000000000000000
[ 1239.760993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1239.767560] CR2: 00007f5a8ecc27b0 CR3: 000000010608e000 CR4: 00000000001006f0
[ 1239.775679] Kernel panic - not syncing: Fatal exception
[ 1239.776630] Kernel Offset: 0x1f000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[ 1239.776630] Rebooting in 5 seconds..
Fixes: 20a69341f2
("netfilter: nf_tables: add netlink set API")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-08-16 19:36:59 +02:00
..
2017-07-11 06:08:58 -04:00
2018-08-10 16:57:57 +02:00
2018-01-19 14:02:12 -05:00
2018-06-28 10:40:47 -07:00
2018-08-16 19:36:59 +02:00
2018-08-13 08:42:25 -07:00
2017-04-05 10:15:20 +02:00
2018-05-16 07:24:30 +02:00
2018-08-11 12:25:15 -07:00
2018-07-20 21:17:12 -07:00
2017-04-12 22:02:36 +02:00
2018-08-11 12:37:10 -07:00
2018-08-11 01:58:46 +02:00
2018-07-13 12:18:18 -04:00
2018-08-03 12:46:20 -07:00
2017-11-02 11:10:55 +01:00
2018-08-07 12:39:13 -07:00
2017-11-02 11:10:55 +01:00
2018-01-15 14:53:43 -05:00
2017-11-02 11:10:55 +01:00
2018-05-16 07:23:35 +02:00
2018-04-19 16:11:11 -04:00
2018-08-04 13:23:15 -07:00
2017-05-27 18:51:41 -04:00
2018-07-11 23:10:19 -07:00
2018-07-30 09:10:25 -07:00
2017-07-04 22:35:16 +01:00
2018-07-24 19:21:58 -07:00
2016-07-08 12:20:57 +02:00
2017-01-20 12:12:13 -05:00
2017-07-04 01:29:04 -07:00
2016-04-19 20:09:25 -04:00
2016-04-25 16:44:27 -04:00
2016-06-25 12:19:35 -04:00
2016-04-25 16:44:27 -04:00
2018-04-02 20:16:17 +02:00
2017-11-02 11:10:55 +01:00
2018-07-27 13:17:50 -07:00
2018-07-12 17:37:13 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-10-18 12:39:36 +01:00
2017-11-30 09:54:25 -05:00
2017-11-04 09:26:51 +09:00
2018-07-18 15:08:31 -07:00
2017-11-02 11:10:55 +01:00
2018-03-05 12:52:45 -05:00
2017-11-04 09:26:51 +09:00
2017-11-02 11:10:55 +01:00
2018-07-20 10:14:41 +02:00
2018-05-20 18:31:42 -04:00
2017-11-02 11:10:55 +01:00
2018-02-28 11:43:28 -05:00
2018-05-28 22:59:54 -04:00
2017-11-01 11:50:43 +09:00
2018-04-23 10:21:24 -04:00
2017-11-02 11:10:55 +01:00
2018-08-07 12:22:14 -07:00
2018-07-20 10:14:41 +02:00
2017-11-02 11:10:55 +01:00
2017-10-30 21:09:24 +09:00
2017-10-11 09:49:34 +02:00
2017-11-02 11:10:55 +01:00
2018-08-11 12:37:10 -07:00
2017-11-16 10:49:00 +09:00
2017-11-02 11:10:55 +01:00
2018-02-27 14:46:26 -05:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-12-11 14:10:06 -05:00
2017-11-02 11:10:55 +01:00
2016-04-27 22:48:25 -04:00
2018-06-15 14:04:00 +02:00
2018-05-29 10:12:45 -04:00
2018-04-22 21:12:00 -04:00
2017-01-18 13:04:28 -05:00
2017-08-07 11:39:22 -07:00
2018-06-26 11:33:04 +09:00
2018-08-14 10:04:36 -07:00
2017-11-04 09:26:51 +09:00
2018-08-11 17:54:18 -07:00
2017-12-03 10:18:28 -05:00
2018-08-01 09:50:04 -07:00
2018-06-05 10:45:24 -04:00
2017-11-02 11:10:55 +01:00
2018-07-23 11:19:02 -07:00
2018-07-04 15:22:13 +09:00
2017-12-15 12:34:00 -05:00
2018-05-22 10:51:09 +02:00
2018-06-29 23:50:26 +09:00
2018-07-18 11:26:40 +02:00
2018-07-07 10:58:49 +09:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-07-18 11:26:53 +02:00
2018-08-01 13:45:31 -07:00
2017-11-02 11:10:55 +01:00
2018-03-27 09:51:23 +02:00
2016-08-17 19:36:23 -04:00
2016-10-13 12:05:26 -04:00
2018-07-11 23:10:19 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-10-25 12:06:25 +09:00
2018-04-22 14:55:03 -04:00
2018-08-07 15:54:00 -07:00
2018-02-14 14:43:32 -05:00
2018-06-18 22:40:32 +02:00
2016-07-08 13:23:12 +02:00
2017-11-02 11:10:55 +01:00
2017-04-01 20:21:44 -07:00
2016-10-03 02:00:22 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-04-25 13:19:59 -04:00
2018-05-28 22:59:54 -04:00
2018-07-20 23:44:36 -07:00
2017-11-02 11:10:55 +01:00
2018-08-01 09:52:30 -07:00
2017-07-01 07:39:09 -07:00
2017-11-02 11:10:55 +01:00
2018-05-16 07:23:35 +02:00
2018-04-07 22:32:31 -04:00
2016-07-08 12:20:57 +02:00
2017-11-08 16:12:33 +09:00
2017-11-02 11:10:55 +01:00
2018-05-24 18:36:15 -07:00
2018-05-16 07:23:35 +02:00
2018-08-01 10:06:19 -07:00
2018-07-04 22:30:27 +09:00
2017-11-02 11:10:55 +01:00
2017-10-01 03:55:47 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-05-16 07:23:35 +02:00
2017-11-02 11:10:55 +01:00
2017-12-05 14:37:13 -05:00
2018-03-29 11:11:40 +02:00
2017-10-20 13:21:36 +01:00
2018-05-16 07:23:35 +02:00
2018-05-29 10:12:45 -04:00
2018-03-13 18:37:02 +02:00
2018-05-31 22:48:46 -04:00
2018-07-30 09:31:14 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-06-22 13:43:27 +09:00
2018-07-31 09:22:48 +02:00
2018-06-22 13:43:27 +09:00
2018-04-11 10:33:46 -04:00
2018-06-30 20:42:25 +09:00
2016-04-28 11:49:45 -04:00
2018-08-11 01:58:46 +02:00
2018-07-31 12:40:22 -07:00
2018-03-01 21:21:36 -05:00
2017-11-02 11:10:55 +01:00
2018-06-06 14:07:53 -04:00
2018-05-03 13:46:47 -04:00
2018-02-21 15:06:05 -05:00
2018-08-11 01:58:45 +02:00
2018-05-08 00:02:41 -04:00
2018-08-13 08:41:09 -07:00
2018-07-07 10:58:49 +09:00
2017-11-02 11:10:55 +01:00
2017-08-29 15:16:52 -07:00
2018-06-26 11:33:04 +09:00
2018-07-03 10:29:26 +09:00
2018-02-16 15:57:42 -05:00
2018-04-17 13:53:13 -04:00
2018-01-24 19:13:45 -05:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-07-02 18:37:12 -07:00
2018-08-10 16:12:20 +02:00
2018-08-15 15:04:25 -07:00