Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <00000000000057fd27059aa1dfca@google.com> <20191227003310.16061-1-fw@strlen.de>
In-Reply-To: <20191227003310.16061-1-fw@strlen.de>
From:   Cong Wang <xiyou.wangcong@gmail.com>
Date:   Thu, 26 Dec 2019 20:17:52 -0800
Message-ID: <CAM_iQpW5stB_BshUJr0O3uDyaxDcqN-13ZqRr7dcmcJcBp-Tfg@mail.gmail.com>
Subject: Re: [PATCH nf] netfilter: arp_tables: init netns pointer in
 xt_tgchk_param struct
To:     Florian Westphal <fw@strlen.de>
Cc:     NetFilter <netfilter-devel@vger.kernel.org>,
        syzbot+d7358a458d8a81aee898@syzkaller.appspotmail.com,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Linux Kernel Network Developers <netdev@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Dec 26, 2019 at 4:37 PM Florian Westphal <fw@strlen.de> wrote:
>
> We get crash when the targets checkentry function tries to make
> use of the network namespace pointer for arptables.
>
> When the net pointer got added back in 2010, only ip/ip6/ebtables were
> changed to initialize it, so arptables has this set to NULL.
>
> This isn't a problem for normal arptables because no existing
> arptables target has a checkentry function that makes use of par->net.
>
> However, direct users of the setsockopt interface can provide any
> target they want as long as its registered for ARP or UNPSEC protocols.
>
> syzkaller managed to send a semi-valid arptables rule for RATEEST target
> which is enough to trigger NULL deref:
>
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> RIP: xt_rateest_tg_checkentry+0x11d/0xb40 net/netfilter/xt_RATEEST.c:109
> [..]
>  xt_check_target+0x283/0x690 net/netfilter/x_tables.c:1019
>  check_target net/ipv4/netfilter/arp_tables.c:399 [inline]
>  find_check_entry net/ipv4/netfilter/arp_tables.c:422 [inline]
>  translate_table+0x1005/0x1d70 net/ipv4/netfilter/arp_tables.c:572
>  do_replace net/ipv4/netfilter/arp_tables.c:977 [inline]
>  do_arpt_set_ctl+0x310/0x640 net/ipv4/netfilter/arp_tables.c:1456
>
> Fixes: add67461240c1d ("netfilter: add struct net * to target parameters")
> Reported-by: syzbot+d7358a458d8a81aee898@syzkaller.appspotmail.com
> Signed-off-by: Florian Westphal <fw@strlen.de>

I was about to send out a same patch.

So:
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>

Thanks.