Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\))
Subject: Re: [PATCH linux-5.9 1/1] net: netfilter: fix KASAN:
 slab-out-of-bounds Read in nft_flow_rule_create
From:   Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>
In-Reply-To: <20201020115047.GA15628@salvia>
Date:   Tue, 20 Oct 2020 09:45:57 -0700
Cc:     linux-kernel@vger.kernel.org, kadlec@netfilter.org, fw@strlen.de,
        davem@davemloft.net, kuba@kernel.org,
        netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
        netdev@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <28C74722-8F35-4397-B567-FA5BCF525891@oracle.com>
References: <20201019172532.3906-1-saeed.mirzamohammadi@oracle.com>
 <20201020115047.GA15628@salvia>
To:     Pablo Neira Ayuso <pablo@netfilter.org>
Precedence: bulk

Thanks! Yes, that looks good to me.

Saeed

> On Oct 20, 2020, at 4:50 AM, Pablo Neira Ayuso <pablo@netfilter.org> =
wrote:
>=20
> On Mon, Oct 19, 2020 at 10:25:32AM -0700, =
saeed.mirzamohammadi@oracle.com wrote:
>> From: Saeed Mirzamohammadi <saeed.mirzamohammadi@oracle.com>
>>=20
>> This patch fixes the issue due to:
>>=20
>> BUG: KASAN: slab-out-of-bounds in nft_flow_rule_create+0x622/0x6a2
>> net/netfilter/nf_tables_offload.c:40
>> Read of size 8 at addr ffff888103910b58 by task syz-executor227/16244
>>=20
>> The error happens when expr->ops is accessed early on before =
performing the boundary check and after nft_expr_next() moves the expr =
to go out-of-bounds.
>>=20
>> This patch checks the boundary condition before expr->ops that fixes =
the slab-out-of-bounds Read issue.
>=20
> Thanks. I made a slight variant of your patch.
>=20
> I'm attaching it, it is also fixing the problem but it introduced
> nft_expr_more() and use it everywhere.
>=20
> Let me know if this looks fine to you.
> <0001-netfilter-fix-KASAN-slab-out-of-bounds-Read-in-nft_f.patch>