Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp2016724imu; Fri, 14 Dec 2018 04:33:48 -0800 (PST) X-Google-Smtp-Source: AFSGD/XzT/boB0SVEBu4/nXpH0NxNm0QuEEpxzD+jK2icBH4iUnXfWUOOPHsKoRlMPRi6DIymJWc X-Received: by 2002:a17:902:f01:: with SMTP id 1mr2625813ply.143.1544790828077; Fri, 14 Dec 2018 04:33:48 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1544790828; cv=none; d=google.com; s=arc-20160816; b=EMWSfXYJB6GATXj1cR/P95Z7iCRgIFeZ6XXjkDipZhGbxwk/yaccHFjGYMU5pokace ZjLQ05G+vLcXWvleQXkx4Npi5aZ6iMD8HMDvm96XauxBX0/eK1wao4tp95sO/b/quZAH FZBvZhd1Pner2xRAXu+cH1frO+eGHIDmS+aO6xyPL2EZZ936dGp9UuFEOFMMHG9EN7w1 OkfPG4BjKqZdKyjoja9wFR0b8paqsqcYR6TLyKW5QZQOIwx1OYfK6nT15WEfMuDNN9yu 54deZheWxSxiJEk2v0YJx+z4vKu8uyg8xOTWhHGUg0HxjCuo8xwR7qFUZU7f1Ri5/SBf BQbA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=SM1H6FAjagtOwMDuti8igU8MWaTxwR/4lmWM+IJbKPw=; b=IYE0/feMAP82Y7cGVCf1ruh1vunzByIo61HCzRXjWrG/2RqEc5hpvftILNlbZ4iB1E o72TIcbfDqfneCd2iMuDboqngAfy/lrEW5OgrI2cukeAcOLRmABE71lZ+Fw4idn8KJNi wTumx7zqkdSs3L9xRUXYc1OMdIa/6FW9GP3JhDaH10HMYUcOHXZDOjvkCF+rRKOfAejU 0yOW5I+hlZzaTjtEuqBZ7mM7DbUpS8ozpftP/CoHnA5ODB/hjw9Rg2DYo9a8dcPg7xyq ex0kPgkIXfrkB+AdD85oRdUAbRRjSO+bepi8+/WKG+6lle/WycQlDbp49ZIwVkykinTg UhNA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=CQNA0AId; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bf4si3933779plb.163.2018.12.14.04.33.31; Fri, 14 Dec 2018 04:33:48 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=CQNA0AId; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731521AbeLNMcj (ORCPT + 99 others); Fri, 14 Dec 2018 07:32:39 -0500 Received: from mail.kernel.org ([198.145.29.99]:54628 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730274AbeLNMJB (ORCPT ); Fri, 14 Dec 2018 07:09:01 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C4B19214AE; Fri, 14 Dec 2018 12:09:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544789341; bh=rEATTkx2UkX8phiMbMZKFxoj4ObMoKih62cQ6AAkjvI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CQNA0AId35fKZ1LljqsLuK20TbRN6XTiUwDhP7+yaVwWydLndmiaM9nQZyCLEkfPs AatyEVS2uZ0ycJ+a/yi5rUv+GyHgT3y2jv/SlDzxsAx9fTpq+CsWtuGQPpMN9dcM+h O+oMNrVQpxuemq3QZjf7rovJfTMWEmg3Ywqc7AEM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso , Florian Westphal , Sasha Levin Subject: [PATCH 4.14 23/89] netfilter: nf_tables: fix use-after-free when deleting compat expressions Date: Fri, 14 Dec 2018 12:59:36 +0100 Message-Id: <20181214115730.826913856@linuxfoundation.org> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20181214115729.658859279@linuxfoundation.org> References: <20181214115729.658859279@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 29e3880109e357fdc607b4393f8308cef6af9413 ] nft_compat ops do not have static storage duration, unlike all other expressions. When nf_tables_expr_destroy() returns, expr->ops might have been free'd already, so we need to store next address before calling expression destructor. For same reason, we can't deref match pointer after nft_xt_put(). This can be easily reproduced by adding msleep() before nft_match_destroy() returns. Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Reported-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_tables_api.c | 5 +++-- net/netfilter/nft_compat.c | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3ae365f92bff..ea1e57daf50e 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2252,7 +2252,7 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk, static void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule) { - struct nft_expr *expr; + struct nft_expr *expr, *next; /* * Careful: some expressions might not be initialized in case this @@ -2260,8 +2260,9 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx, */ expr = nft_expr_first(rule); while (expr != nft_expr_last(rule) && expr->ops) { + next = nft_expr_next(expr); nf_tables_expr_destroy(ctx, expr); - expr = nft_expr_next(expr); + expr = next; } kfree(rule); } diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c index 6da1cec1494a..7533c2fd6b76 100644 --- a/net/netfilter/nft_compat.c +++ b/net/netfilter/nft_compat.c @@ -497,6 +497,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, void *info) { struct xt_match *match = expr->ops->data; + struct module *me = match->me; struct xt_mtdtor_param par; par.net = ctx->net; @@ -507,7 +508,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, par.match->destroy(&par); if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) - module_put(match->me); + module_put(me); } static void -- 2.19.1