Received: by 2002:a25:8b91:0:0:0:0:0 with SMTP id j17csp448694ybl; Tue, 28 Jan 2020 06:09:51 -0800 (PST) X-Google-Smtp-Source: APXvYqwJovyzgR0jGDEEkgVMO2EZckSgvP6VMjsdCPabhKqQLEcgI+bQjjzItH8HhXGFhUzJF2uv X-Received: by 2002:aca:4b0f:: with SMTP id y15mr2802459oia.153.1580220591756; Tue, 28 Jan 2020 06:09:51 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1580220591; cv=none; d=google.com; s=arc-20160816; b=Kn3zEIo2SAQHjyaNIgNokBaq650wV850slU9k7iC7MeijvZBuupCF0QkdlDfrXyKKT xpLLLrpsRHJgVMVcsH/Stb+jIhMW1LZfdEy9sahB6pxkSG/U3610/djyoFTtFyCEd+8Q RMLS8xcbhjTrUmhDDfLIUiY+oxceMUhAgzjoZ5OjeyNxq92MWYwEcZ/QHy3y1ozAOSvH IAQ8DPYL1YWJLhpKmjwkbuM0JLjbGGNs60m44wUraL9U0dBGyp8N0CLUeCBPaX5B4+6c 5JxOeOdHGilFA5KXW8JGRb+3h6+ZtbBnHZ8t55d5k3fJQxIko4AdHO22PgurZIJgtuAt MKVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Ts2AI8SPlPfJ6YqUHBjaR7MQOdkktmv8YMCKPVvchSs=; b=p+SWaw2uLdAjuN2OP4uSoidG7Cyn0DdC5jZhoY8g4qXfAygDZk8P7Fsb5AHR6p1zmQ 7ZjxZGA7YJGvPtfmHYyej0QPa2PLLN1URg3+FFdKkgu5RdwXXf8ZaPbsfSAZtmFKFaEb JFBlWmuBTbx+rBnnQKbfddIBfoZVDHBSl2KL62E4RoQoPeNfxqgkqd2sCBpky97dXl5q yfNzfZsKpxMrF0TIC0veTfJP+F20bdR2JxU4l1PXvUdip5bRODklkMRfUh+xfCSTX3n0 1hRcl3jlujE7yokWKcKXdc4o3vaaHKpiZi7ROeiYO6kLJAL6wrc1Kke62x9Tw4RssJ7A T/3Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=UrLCmcr+; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p25si8765463oto.191.2020.01.28.06.09.35; Tue, 28 Jan 2020 06:09:51 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=UrLCmcr+; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727902AbgA1OHL (ORCPT + 99 others); Tue, 28 Jan 2020 09:07:11 -0500 Received: from mail.kernel.org ([198.145.29.99]:50896 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727960AbgA1OD5 (ORCPT ); Tue, 28 Jan 2020 09:03:57 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 94891205F4; Tue, 28 Jan 2020 14:03:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1580220237; bh=4ur1Ix63mEhL4kZuXF7GWGOWcQMmuI6lxxCh9xmTNZI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UrLCmcr+CZpjnmTMssESJkMe68TYSVDmc+typSR5Acntt0oBaqB1eDqjGbC7vaUO1 02mtlvrW2uqtg7116YmLoJ0GZm8VUiufz8o8AJfHWRdWECHGThhq+vcjRizYZVw6fi 67n/FdFdzlAYwLlX/oKKaaiwYwAKGyu1YSHTyS8s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+cf23983d697c26c34f60@syzkaller.appspotmail.com, Florian Westphal , Pablo Neira Ayuso Subject: [PATCH 5.4 070/104] netfilter: nft_osf: add missing check for DREG attribute Date: Tue, 28 Jan 2020 15:00:31 +0100 Message-Id: <20200128135827.019998828@linuxfoundation.org> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200128135817.238524998@linuxfoundation.org> References: <20200128135817.238524998@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Florian Westphal commit 7eaecf7963c1c8f62d62c6a8e7c439b0e7f2d365 upstream. syzbot reports just another NULL deref crash because of missing test for presence of the attribute. Reported-by: syzbot+cf23983d697c26c34f60@syzkaller.appspotmail.com Fixes: b96af92d6eaf9fadd ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nft_osf.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/netfilter/nft_osf.c +++ b/net/netfilter/nft_osf.c @@ -61,6 +61,9 @@ static int nft_osf_init(const struct nft int err; u8 ttl; + if (!tb[NFTA_OSF_DREG]) + return -EINVAL; + if (tb[NFTA_OSF_TTL]) { ttl = nla_get_u8(tb[NFTA_OSF_TTL]); if (ttl > 2)