From: Saeed Mirzamohammadi <[email protected]>
This patch fixes the issue due to:
BUG: KASAN: slab-out-of-bounds in nft_flow_rule_create+0x622/0x6a2
net/netfilter/nf_tables_offload.c:40
Read of size 8 at addr ffff888103910b58 by task syz-executor227/16244
The error happens when expr->ops is accessed early on before performing the boundary check and after nft_expr_next() moves the expr to go out-of-bounds.
This patch checks the boundary condition before expr->ops that fixes the slab-out-of-bounds Read issue.
Signed-off-by: Saeed Mirzamohammadi <[email protected]>
---
net/netfilter/nf_tables_offload.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 9ef37c1b7b3b..1273e3c0d4b8 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -37,7 +37,7 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net,
struct nft_expr *expr;
expr = nft_expr_first(rule);
- while (expr->ops && expr != nft_expr_last(rule)) {
+ while (expr != nft_expr_last(rule) && expr->ops) {
if (expr->ops->offload_flags & NFT_OFFLOAD_F_ACTION)
num_actions++;
@@ -61,7 +61,7 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net,
ctx->net = net;
ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
- while (expr->ops && expr != nft_expr_last(rule)) {
+ while (expr != nft_expr_last(rule) && expr->ops) {
if (!expr->ops->offload) {
err = -EOPNOTSUPP;
goto err_out;
--
2.27.0
On Mon, Oct 19, 2020 at 10:25:32AM -0700, [email protected] wrote:
> From: Saeed Mirzamohammadi <[email protected]>
>
> This patch fixes the issue due to:
>
> BUG: KASAN: slab-out-of-bounds in nft_flow_rule_create+0x622/0x6a2
> net/netfilter/nf_tables_offload.c:40
> Read of size 8 at addr ffff888103910b58 by task syz-executor227/16244
>
> The error happens when expr->ops is accessed early on before performing the boundary check and after nft_expr_next() moves the expr to go out-of-bounds.
>
> This patch checks the boundary condition before expr->ops that fixes the slab-out-of-bounds Read issue.
Thanks. I made a slight variant of your patch.
I'm attaching it, it is also fixing the problem but it introduced
nft_expr_more() and use it everywhere.
Let me know if this looks fine to you.
Thanks! Yes, that looks good to me.
Saeed
> On Oct 20, 2020, at 4:50 AM, Pablo Neira Ayuso <[email protected]> wrote:
>
> On Mon, Oct 19, 2020 at 10:25:32AM -0700, [email protected] wrote:
>> From: Saeed Mirzamohammadi <[email protected]>
>>
>> This patch fixes the issue due to:
>>
>> BUG: KASAN: slab-out-of-bounds in nft_flow_rule_create+0x622/0x6a2
>> net/netfilter/nf_tables_offload.c:40
>> Read of size 8 at addr ffff888103910b58 by task syz-executor227/16244
>>
>> The error happens when expr->ops is accessed early on before performing the boundary check and after nft_expr_next() moves the expr to go out-of-bounds.
>>
>> This patch checks the boundary condition before expr->ops that fixes the slab-out-of-bounds Read issue.
>
> Thanks. I made a slight variant of your patch.
>
> I'm attaching it, it is also fixing the problem but it introduced
> nft_expr_more() and use it everywhere.
>
> Let me know if this looks fine to you.
> <0001-netfilter-fix-KASAN-slab-out-of-bounds-Read-in-nft_f.patch>
> On Oct 20, 2020, at 9:45 AM, Saeed Mirzamohammadi <[email protected]> wrote:
>
> Thanks! Yes, that looks good to me.
>
> Saeed
>
>> On Oct 20, 2020, at 4:50 AM, Pablo Neira Ayuso <[email protected]> wrote:
>>
>> On Mon, Oct 19, 2020 at 10:25:32AM -0700, [email protected] wrote:
>>> From: Saeed Mirzamohammadi <[email protected]>
>>>
>>> This patch fixes the issue due to:
>>>
>>> BUG: KASAN: slab-out-of-bounds in nft_flow_rule_create+0x622/0x6a2
>>> net/netfilter/nf_tables_offload.c:40
>>> Read of size 8 at addr ffff888103910b58 by task syz-executor227/16244
>>>
>>> The error happens when expr->ops is accessed early on before performing the boundary check and after nft_expr_next() moves the expr to go out-of-bounds.
>>>
>>> This patch checks the boundary condition before expr->ops that fixes the slab-out-of-bounds Read issue.
>>
>> Thanks. I made a slight variant of your patch.
>>
>> I'm attaching it, it is also fixing the problem but it introduced
>> nft_expr_more() and use it everywhere.
>>
>> Let me know if this looks fine to you.
>> <0001-netfilter-fix-KASAN-slab-out-of-bounds-Read-in-nft_f.patch>
>
Adding stable.
> On Oct 21, 2020, at 1:08 PM, Saeed Mirzamohammadi <[email protected]> wrote:
>
> Attached the syzkaller C repro.
>
> Tested-by: Saeed Mirzamohammadi <[email protected]>
> <repro.c>
>> On Oct 20, 2020, at 9:45 AM, Saeed Mirzamohammadi <[email protected]> wrote:
>>
>> Thanks! Yes, that looks good to me.
>>
>> Saeed
>>
>>> On Oct 20, 2020, at 4:50 AM, Pablo Neira Ayuso <[email protected]> wrote:
>>>
>>> On Mon, Oct 19, 2020 at 10:25:32AM -0700, [email protected] wrote:
>>>> From: Saeed Mirzamohammadi <[email protected]>
>>>>
>>>> This patch fixes the issue due to:
>>>>
>>>> BUG: KASAN: slab-out-of-bounds in nft_flow_rule_create+0x622/0x6a2
>>>> net/netfilter/nf_tables_offload.c:40
>>>> Read of size 8 at addr ffff888103910b58 by task syz-executor227/16244
>>>>
>>>> The error happens when expr->ops is accessed early on before performing the boundary check and after nft_expr_next() moves the expr to go out-of-bounds.
>>>>
>>>> This patch checks the boundary condition before expr->ops that fixes the slab-out-of-bounds Read issue.
>>>
>>> Thanks. I made a slight variant of your patch.
>>>
>>> I'm attaching it, it is also fixing the problem but it introduced
>>> nft_expr_more() and use it everywhere.
>>>
>>> Let me know if this looks fine to you.
>>> <0001-netfilter-fix-KASAN-slab-out-of-bounds-Read-in-nft_f.patch>
>>
>
On Sun, Oct 25, 2020 at 04:31:57PM -0700, Saeed Mirzamohammadi wrote:
> Adding stable.
What did that do?
confused,
greg k-h
On Tue, Oct 27, 2020 at 07:42:26AM +0100, Florian Westphal wrote:
> Greg KH <[email protected]> wrote:
>
> [ Trimming CC ]
>
> > On Sun, Oct 25, 2020 at 04:31:57PM -0700, Saeed Mirzamohammadi wrote:
> > > Adding stable.
> >
> > What did that do?
>
> Its a request to pick up
>
> commit 31cc578ae2de19c748af06d859019dced68e325d
> Author: Saeed Mirzamohammadi <[email protected]>
> Date: Tue Oct 20 13:41:36 2020 +0200
>
> netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
>
> Which lacks a Fixes tag. Should have been:
>
> Fixes: c9626a2cbdb20e2 ("netfilter: nf_tables: add hardware offload support")
> (v5.3+)
>
> Hope that makes things clearer.
That makes it much more obvious and clearer, thank you. Saeed, please
be more explicit in the future.
thanks,
greg k-h
Greg KH <[email protected]> wrote:
[ Trimming CC ]
> On Sun, Oct 25, 2020 at 04:31:57PM -0700, Saeed Mirzamohammadi wrote:
> > Adding stable.
>
> What did that do?
Its a request to pick up
commit 31cc578ae2de19c748af06d859019dced68e325d
Author: Saeed Mirzamohammadi <[email protected]>
Date: Tue Oct 20 13:41:36 2020 +0200
netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create
Which lacks a Fixes tag. Should have been:
Fixes: c9626a2cbdb20e2 ("netfilter: nf_tables: add hardware offload support")
(v5.3+)
Hope that makes things clearer.
Hi Greg,
On Tue, Oct 27, 2020 at 07:21:11AM +0100, Greg KH wrote:
> On Sun, Oct 25, 2020 at 04:31:57PM -0700, Saeed Mirzamohammadi wrote:
> > Adding stable.
>
> What did that do?
Saeed is requesting that stable maintainers cherry-picks this patch:
31cc578ae2de ("netfilter: nftables_offload: KASAN slab-out-of-bounds
Read in nft_flow_rule_create")
into stable 5.4 and 5.8.
Thanks.
On Tue, Oct 27, 2020 at 09:19:22AM +0100, Pablo Neira Ayuso wrote:
> Hi Greg,
>
> On Tue, Oct 27, 2020 at 07:21:11AM +0100, Greg KH wrote:
> > On Sun, Oct 25, 2020 at 04:31:57PM -0700, Saeed Mirzamohammadi wrote:
> > > Adding stable.
> >
> > What did that do?
>
> Saeed is requesting that stable maintainers cherry-picks this patch:
>
> 31cc578ae2de ("netfilter: nftables_offload: KASAN slab-out-of-bounds
> Read in nft_flow_rule_create")
>
> into stable 5.4 and 5.8.
5.9 is also a stable kernel :)
Will go queue it up everywhere...
thanks,
greg k-h
On Thu, Oct 29, 2020 at 12:02:41PM +0100, Greg KH wrote:
> On Tue, Oct 27, 2020 at 09:19:22AM +0100, Pablo Neira Ayuso wrote:
> > Hi Greg,
> >
> > On Tue, Oct 27, 2020 at 07:21:11AM +0100, Greg KH wrote:
> > > On Sun, Oct 25, 2020 at 04:31:57PM -0700, Saeed Mirzamohammadi wrote:
> > > > Adding stable.
> > >
> > > What did that do?
> >
> > Saeed is requesting that stable maintainers cherry-picks this patch:
> >
> > 31cc578ae2de ("netfilter: nftables_offload: KASAN slab-out-of-bounds
> > Read in nft_flow_rule_create")
> >
> > into stable 5.4 and 5.8.
>
> 5.9 is also a stable kernel :)
Oh, indeed, I forgot this one :)
> Will go queue it up everywhere...
Thanks.