Alexey Kodanev 9c7f96fd77 netfilter: nf_tables: check msg_type before nft_trans_set(trans) ... The patch moves the "trans->msg_type == NFT_MSG_NEWSET" check before using nft_trans_set(trans). Otherwise we can get out of bounds read. For example, KASAN reported the one when running 0001_cache_handling_0 nft test. In this case "trans->msg_type" was NFT_MSG_NEWTABLE: [75517.177808] BUG: KASAN: slab-out-of-bounds in nft_set_lookup_global+0x22f/0x270 [nf_tables] [75517.279094] Read of size 8 at addr ffff881bdb643fc8 by task nft/7356 ... [75517.375605] CPU: 26 PID: 7356 Comm: nft Tainted: G E 4.17.0-rc7.1.x86_64 #1 [75517.489587] Hardware name: Oracle Corporation SUN SERVER X4-2 [75517.618129] Call Trace: [75517.648821] dump_stack+0xd1/0x13b [75517.691040] ? show_regs_print_info+0x5/0x5 [75517.742519] ? kmsg_dump_rewind_nolock+0xf5/0xf5 [75517.799300] ? lock_acquire+0x143/0x310 [75517.846738] print_address_description+0x85/0x3a0 [75517.904547] kasan_report+0x18d/0x4b0 [75517.949892] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] [75518.019153] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] [75518.088420] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] [75518.157689] nft_set_lookup_global+0x22f/0x270 [nf_tables] [75518.224869] nf_tables_newsetelem+0x1a5/0x5d0 [nf_tables] [75518.291024] ? nft_add_set_elem+0x2280/0x2280 [nf_tables] [75518.357154] ? nla_parse+0x1a5/0x300 [75518.401455] ? kasan_kmalloc+0xa6/0xd0 [75518.447842] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink] [75518.507743] ? nfnetlink_rcv+0x7a5/0x1bdf [nfnetlink] [75518.569745] ? nfnl_err_reset+0x3c0/0x3c0 [nfnetlink] [75518.631711] ? lock_acquire+0x143/0x310 [75518.679133] ? netlink_deliver_tap+0x9b/0x1070 [75518.733840] ? kasan_unpoison_shadow+0x31/0x40 [75518.788542] netlink_unicast+0x45d/0x680 [75518.837111] ? __isolate_free_page+0x890/0x890 [75518.891913] ? netlink_attachskb+0x6b0/0x6b0 [75518.944542] netlink_sendmsg+0x6fa/0xd30 [75518.993107] ? netlink_unicast+0x680/0x680 [75519.043758] ? netlink_unicast+0x680/0x680 [75519.094402] sock_sendmsg+0xd9/0x160 [75519.138810] ___sys_sendmsg+0x64d/0x980 [75519.186234] ? copy_msghdr_from_user+0x350/0x350 [75519.243118] ? lock_downgrade+0x650/0x650 [75519.292738] ? do_raw_spin_unlock+0x5d/0x250 [75519.345456] ? _raw_spin_unlock+0x24/0x30 [75519.395065] ? __handle_mm_fault+0xbde/0x3410 [75519.448830] ? sock_setsockopt+0x3d2/0x1940 [75519.500516] ? __lock_acquire.isra.25+0xdc/0x19d0 [75519.558448] ? lock_downgrade+0x650/0x650 [75519.608057] ? __audit_syscall_entry+0x317/0x720 [75519.664960] ? __fget_light+0x58/0x250 [75519.711325] ? __sys_sendmsg+0xde/0x170 [75519.758850] __sys_sendmsg+0xde/0x170 [75519.804193] ? __ia32_sys_shutdown+0x90/0x90 [75519.856725] ? syscall_trace_enter+0x897/0x10e0 [75519.912354] ? trace_event_raw_event_sys_enter+0x920/0x920 [75519.979432] ? __audit_syscall_entry+0x720/0x720 [75520.036118] do_syscall_64+0xa3/0x3d0 [75520.081248] ? prepare_exit_to_usermode+0x47/0x1d0 [75520.139904] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [75520.201680] RIP: 0033:0x7fc153320ba0 [75520.245772] RSP: 002b:00007ffe294c3638 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [75520.337708] RAX: ffffffffffffffda RBX: 00007ffe294c4820 RCX: 00007fc153320ba0 [75520.424547] RDX: 0000000000000000 RSI: 00007ffe294c46b0 RDI: 0000000000000003 [75520.511386] RBP: 00007ffe294c47b0 R08: 0000000000000004 R09: 0000000002114090 [75520.598225] R10: 00007ffe294c30a0 R11: 0000000000000246 R12: 00007ffe294c3660 [75520.684961] R13: 0000000000000001 R14: 00007ffe294c3650 R15: 0000000000000001 [75520.790946] Allocated by task 7356: [75520.833994] kasan_kmalloc+0xa6/0xd0 [75520.878088] __kmalloc+0x189/0x450 [75520.920107] nft_trans_alloc_gfp+0x20/0x190 [nf_tables] [75520.983961] nf_tables_newtable+0xcd0/0x1bd0 [nf_tables] [75521.048857] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink] [75521.108655] netlink_unicast+0x45d/0x680 [75521.157013] netlink_sendmsg+0x6fa/0xd30 [75521.205271] sock_sendmsg+0xd9/0x160 [75521.249365] ___sys_sendmsg+0x64d/0x980 [75521.296686] __sys_sendmsg+0xde/0x170 [75521.341822] do_syscall_64+0xa3/0x3d0 [75521.386957] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [75521.467867] Freed by task 23454: [75521.507804] __kasan_slab_free+0x132/0x180 [75521.558137] kfree+0x14d/0x4d0 [75521.596005] free_rt_sched_group+0x153/0x280 [75521.648410] sched_autogroup_create_attach+0x19a/0x520 [75521.711330] ksys_setsid+0x2ba/0x400 [75521.755529] __ia32_sys_setsid+0xa/0x10 [75521.802850] do_syscall_64+0xa3/0x3d0 [75521.848090] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [75521.929000] The buggy address belongs to the object at ffff881bdb643f80 which belongs to the cache kmalloc-96 of size 96 [75522.079797] The buggy address is located 72 bytes inside of 96-byte region [ffff881bdb643f80, ffff881bdb643fe0) [75522.221234] The buggy address belongs to the page: [75522.280100] page:ffffea006f6d90c0 count:1 mapcount:0 mapping:0000000000000000 index:0x0 [75522.377443] flags: 0x2fffff80000100(slab) [75522.426956] raw: 002fffff80000100 0000000000000000 0000000000000000 0000000180200020 [75522.521275] raw: ffffea006e6fafc0 0000000c0000000c ffff881bf180f400 0000000000000000 [75522.615601] page dumped because: kasan: bad access detected Fixes: 37a9cc5255 ("netfilter: nf_tables: add generation mask to sets") Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2018-06-01 10:14:51 +02:00
..
6lowpan
9p	Merge candidates for 4.17-rc	2018-05-24 14:12:05 -07:00
802
8021q	vlan: also check phy_driver ts_info for vlan's real device	2018-04-01 20:53:50 -04:00
appletalk	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
atm	net: atm: Fix potential Spectre v1	2018-05-04 12:52:47 -04:00
ax25	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
batman-adv	batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs	2018-05-12 18:53:08 +02:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth	2018-04-08 17:19:15 -04:00
bpf	bpf: fix null pointer deref in bpf_prog_test_run_xdp	2018-02-01 07:43:56 -08:00
bridge	netfilter: ebtables: handle string from userspace with care	2018-05-17 13:48:48 +02:00
caif	net: caif: fix spelling mistake "UKNOWN" -> "UNKNOWN"	2018-04-19 13:37:10 -04:00
can	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
ceph	libceph: add osd_req_op_extent_osd_data_bvecs()	2018-05-10 10:15:05 +02:00
core	net-sysfs: Fix memory leak in XPS configuration	2018-05-31 23:02:42 -04:00
dcb
dccp	dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()	2018-05-22 13:55:20 -04:00
decnet	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
dns_resolver	KEYS: DNS: limit the length of option strings	2018-04-17 15:17:41 -04:00
dsa	net: dsa: Do not register devlink for unused ports	2018-05-18 12:08:25 -04:00
ethernet
hsr
ieee802154	net: ieee802154: 6lowpan: fix frag reassembly	2018-04-23 20:56:24 +02:00
ife	net: sched: ife: check on metadata length	2018-04-22 21:12:00 -04:00
ipv4	ipv4: remove warning in ip_recv_error	2018-05-24 22:16:57 -04:00
ipv6	ipv6: sr: fix memory OOB access in seg6_do_srh_encap/inline	2018-05-28 23:09:49 -04:00
iucv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-03-23 11:31:58 -04:00
kcm	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
key	af_key: Always verify length of provided sadb_key	2018-04-09 07:06:38 +02:00
l2tp	l2tp: check sockaddr length in pppol2tp_connect()	2018-04-23 21:10:43 -04:00
l3mdev
lapb
llc	llc: better deal with too small mtu	2018-05-08 00:11:40 -04:00
mac80211	mac80211: mesh: fix premature update of rc stats	2018-05-18 10:02:28 +02:00
mac802154	net/mac802154: disambiguate mac80215 vs mac802154 trace events	2018-03-28 22:55:18 +02:00
mpls	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
ncsi	net/ncsi: Fix array size in dumpit handler	2018-05-31 15:57:54 -04:00
netfilter	netfilter: nf_tables: check msg_type before nft_trans_set(trans)	2018-06-01 10:14:51 +02:00
netlabel	netlabel: If PF_INET6, check sk_buff ip header version	2018-02-14 14:01:41 -05:00
netlink	net/netlink: make sure the headers line up actual value output	2018-05-04 13:00:57 -04:00
netrom	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-02-19 18:46:11 -05:00
nsh	nsh: fix infinite loop	2018-05-04 12:54:38 -04:00
openvswitch	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found	2018-05-04 12:51:02 -04:00
packet	packet: fix reserve calculation	2018-05-24 21:55:20 -04:00
phonet	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
psample
qrtr	net: qrtr: add MODULE_ALIAS_NETPROTO macro	2018-04-17 09:58:00 -04:00
rds	Merge candidates for 4.17-rc	2018-05-24 14:12:05 -07:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-07 15:01:40 +02:00
rose	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
rxrpc	rxrpc: Trace UDP transmission failure	2018-05-10 23:26:01 +01:00
sched	cls_flower: Fix incorrect idr release when failing to modify rule	2018-05-31 15:18:44 -04:00
sctp	sctp: fix the issue that flags are ignored when using kernel_connect	2018-05-22 13:37:26 -04:00
smc	net/smc: check for missing nlattrs in SMC_PNETID messages	2018-05-14 16:40:45 -04:00
strparser	strparser: Do not call mod_delayed_work with a timeout of LONG_MAX	2018-04-22 21:09:16 -04:00
sunrpc	Merge candidates for 4.17-rc	2018-05-24 14:12:05 -07:00
switchdev
tipc	tipc: fix one byte leak in tipc_sk_set_orig_addr()	2018-05-10 17:28:39 -04:00
tls	tls: don't use stack memory in a scatterlist	2018-05-17 14:49:38 -04:00
unix	af_unix: remove redundant lockdep class	2018-04-04 11:13:40 -04:00
vmw_vsock	VSOCK: make af_vsock.ko removable again	2018-04-17 09:44:30 -04:00
wimax
wireless	cfg80211: fix NULL pointer derference when querying regdb	2018-05-22 10:17:52 +02:00
x25	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
xfrm	xfrm: Fix warning in xfrm6_tunnel_net_exit.	2018-04-16 07:50:09 +02:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-04-27 19:46:06 -04:00
Kconfig	Staging/IIO patches for 4.16-rc1	2018-02-01 09:51:57 -08:00
Makefile
socket.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2018-04-05 11:56:35 -07:00
sysctl_net.c	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00