* [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
@ 2015-11-16 11:00 Pablo Neira Ayuso
2015-11-16 11:00 ` [PATCH -stable,4.3.y] netfilter: xt_TEE: fix NULL dereference Pablo Neira Ayuso
0 siblings, 1 reply; 9+ messages in thread
From: Pablo Neira Ayuso @ 2015-11-16 11:00 UTC (permalink / raw)
To: netfilter-devel; +Cc: stable, Munehisa Kamata
From: Munehisa Kamata <kamatam@amazon.com>
[ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
Commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT
redirect IPv4 to use it from nf_tables") has introduced a trivial logic
change which can result in the following crash.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
IP: [<ffffffffa033002d>] nf_nat_redirect_ipv4+0x2d/0xa0 [nf_nat_redirect]
PGD 3ba662067 PUD 3ba661067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: ipv6(E) xt_REDIRECT(E) nf_nat_redirect(E) xt_tcpudp(E) iptable_nat(E) nf_conntrack_ipv4(E) nf_defrag_ipv4(E) nf_nat_ipv4(E) nf_nat(E) nf_conntrack(E) ip_tables(E) x_tables(E) binfmt_misc(E) xfs(E) libcrc32c(E) evbug(E) evdev(E) psmouse(E) i2c_piix4(E) i2c_core(E) acpi_cpufreq(E) button(E) ext4(E) crc16(E) jbd2(E) mbcache(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E)
CPU: 0 PID: 2536 Comm: ip Tainted: G E 4.1.7-15.23.amzn1.x86_64 #1
Hardware name: Xen HVM domU, BIOS 4.2.amazon 05/06/2015
task: ffff8800eb438000 ti: ffff8803ba664000 task.ti: ffff8803ba664000
[...]
Call Trace:
<IRQ>
[<ffffffffa0334065>] redirect_tg4+0x15/0x20 [xt_REDIRECT]
[<ffffffffa02e2e99>] ipt_do_table+0x2b9/0x5e1 [ip_tables]
[<ffffffffa0328045>] iptable_nat_do_chain+0x25/0x30 [iptable_nat]
[<ffffffffa031777d>] nf_nat_ipv4_fn+0x13d/0x1f0 [nf_nat_ipv4]
[<ffffffffa0328020>] ? iptable_nat_ipv4_fn+0x20/0x20 [iptable_nat]
[<ffffffffa031785e>] nf_nat_ipv4_in+0x2e/0x90 [nf_nat_ipv4]
[<ffffffffa03280a5>] iptable_nat_ipv4_in+0x15/0x20 [iptable_nat]
[<ffffffff81449137>] nf_iterate+0x57/0x80
[<ffffffff814491f7>] nf_hook_slow+0x97/0x100
[<ffffffff814504d4>] ip_rcv+0x314/0x400
unsigned int
nf_nat_redirect_ipv4(struct sk_buff *skb,
...
{
...
rcu_read_lock();
indev = __in_dev_get_rcu(skb->dev);
if (indev != NULL) {
ifa = indev->ifa_list;
newdst = ifa->ifa_local; <---
}
rcu_read_unlock();
...
}
Before the commit, 'ifa' had been always checked before access. After the
commit, however, it could be accessed even if it's NULL. Interestingly,
this was once fixed in 2003.
http://marc.info/?l=netfilter-devel&m=106668497403047&w=2
In addition to the original one, we have seen the crash when packets that
need to be redirected somehow arrive on an interface which hasn't been
yet fully configured.
This change just reverts the logic to the old behavior to avoid the crash.
Fixes: 8b13eddfdf04 ("netfilter: refactor NAT redirect IPv4 to use it from nf_tables")
Cc: <stable@vger.kernel.org> # 4.1.x
Cc: <stable@vger.kernel.org> # 4.2.x
Cc: <stable@vger.kernel.org> # 4.3.x
Signed-off-by: Munehisa Kamata <kamatam@amazon.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_nat_redirect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index 97b75f9..d438698 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -55,7 +55,7 @@ nf_nat_redirect_ipv4(struct sk_buff *skb,
rcu_read_lock();
indev = __in_dev_get_rcu(skb->dev);
- if (indev != NULL) {
+ if (indev && indev->ifa_list) {
ifa = indev->ifa_list;
newdst = ifa->ifa_local;
}
--
2.1.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH -stable,4.3.y] netfilter: xt_TEE: fix NULL dereference
2015-11-16 11:00 [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check Pablo Neira Ayuso
@ 2015-11-16 11:00 ` Pablo Neira Ayuso
0 siblings, 0 replies; 9+ messages in thread
From: Pablo Neira Ayuso @ 2015-11-16 11:00 UTC (permalink / raw)
To: netfilter-devel; +Cc: stable, Eric Dumazet
From: Eric Dumazet <edumazet@google.com>
[ upstream commit 45efccdbec3cd465c4776ed9ca1d7b1bba1b7e34 ]
iptables -I INPUT ... -j TEE --gateway 10.1.2.3
<crash> because --oif was not specified
tee_tg_check() sets ->priv pointer to NULL in this case.
Fixes: bbde9fc1824a ("netfilter: factor out packet duplication for IPv4/IPv6")
Cc: <stable@vger.kernel.org> # 4.3.x
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/xt_TEE.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index fd980aa..c5fdea1 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -31,8 +31,9 @@ static unsigned int
tee_tg4(struct sk_buff *skb, const struct xt_action_param *par)
{
const struct xt_tee_tginfo *info = par->targinfo;
+ int oif = info->priv ? info->priv->oif : 0;
- nf_dup_ipv4(skb, par->hooknum, &info->gw.in, info->priv->oif);
+ nf_dup_ipv4(skb, par->hooknum, &info->gw.in, oif);
return XT_CONTINUE;
}
@@ -42,8 +43,9 @@ static unsigned int
tee_tg6(struct sk_buff *skb, const struct xt_action_param *par)
{
const struct xt_tee_tginfo *info = par->targinfo;
+ int oif = info->priv ? info->priv->oif : 0;
- nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, info->priv->oif);
+ nf_dup_ipv6(skb, par->hooknum, &info->gw.in6, oif);
return XT_CONTINUE;
}
--
2.1.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
@ 2015-11-06 12:44 Pablo Neira Ayuso
2015-11-06 17:08 ` Greg KH
0 siblings, 1 reply; 9+ messages in thread
From: Pablo Neira Ayuso @ 2015-11-06 12:44 UTC (permalink / raw)
To: netfilter-devel; +Cc: stable, Munehisa Kamata
From: Munehisa Kamata <kamatam@amazon.com>
[ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
Commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT
redirect IPv4 to use it from nf_tables") has introduced a trivial logic
change which can result in the following crash.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
IP: [<ffffffffa033002d>] nf_nat_redirect_ipv4+0x2d/0xa0 [nf_nat_redirect]
PGD 3ba662067 PUD 3ba661067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: ipv6(E) xt_REDIRECT(E) nf_nat_redirect(E) xt_tcpudp(E) iptable_nat(E) nf_conntrack_ipv4(E) nf_defrag_ipv4(E) nf_nat_ipv4(E) nf_nat(E) nf_conntrack(E) ip_tables(E) x_tables(E) binfmt_misc(E) xfs(E) libcrc32c(E) evbug(E) evdev(E) psmouse(E) i2c_piix4(E) i2c_core(E) acpi_cpufreq(E) button(E) ext4(E) crc16(E) jbd2(E) mbcache(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E)
CPU: 0 PID: 2536 Comm: ip Tainted: G E 4.1.7-15.23.amzn1.x86_64 #1
Hardware name: Xen HVM domU, BIOS 4.2.amazon 05/06/2015
task: ffff8800eb438000 ti: ffff8803ba664000 task.ti: ffff8803ba664000
[...]
Call Trace:
<IRQ>
[<ffffffffa0334065>] redirect_tg4+0x15/0x20 [xt_REDIRECT]
[<ffffffffa02e2e99>] ipt_do_table+0x2b9/0x5e1 [ip_tables]
[<ffffffffa0328045>] iptable_nat_do_chain+0x25/0x30 [iptable_nat]
[<ffffffffa031777d>] nf_nat_ipv4_fn+0x13d/0x1f0 [nf_nat_ipv4]
[<ffffffffa0328020>] ? iptable_nat_ipv4_fn+0x20/0x20 [iptable_nat]
[<ffffffffa031785e>] nf_nat_ipv4_in+0x2e/0x90 [nf_nat_ipv4]
[<ffffffffa03280a5>] iptable_nat_ipv4_in+0x15/0x20 [iptable_nat]
[<ffffffff81449137>] nf_iterate+0x57/0x80
[<ffffffff814491f7>] nf_hook_slow+0x97/0x100
[<ffffffff814504d4>] ip_rcv+0x314/0x400
unsigned int
nf_nat_redirect_ipv4(struct sk_buff *skb,
...
{
...
rcu_read_lock();
indev = __in_dev_get_rcu(skb->dev);
if (indev != NULL) {
ifa = indev->ifa_list;
newdst = ifa->ifa_local; <---
}
rcu_read_unlock();
...
}
Before the commit, 'ifa' had been always checked before access. After the
commit, however, it could be accessed even if it's NULL. Interestingly,
this was once fixed in 2003.
http://marc.info/?l=netfilter-devel&m=106668497403047&w=2
In addition to the original one, we have seen the crash when packets that
need to be redirected somehow arrive on an interface which hasn't been
yet fully configured.
This change just reverts the logic to the old behavior to avoid the crash.
Fixes: 8b13eddfdf04 ("netfilter: refactor NAT redirect IPv4 to use it from nf_tables")
Cc: <stable@vger.kernel.org> # 4.1.x
Cc: <stable@vger.kernel.org> # 4.2.x
Cc: <stable@vger.kernel.org> # 4.3.x
Signed-off-by: Munehisa Kamata <kamatam@amazon.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_nat_redirect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index 97b75f9..d438698 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -55,7 +55,7 @@ nf_nat_redirect_ipv4(struct sk_buff *skb,
rcu_read_lock();
indev = __in_dev_get_rcu(skb->dev);
- if (indev != NULL) {
+ if (indev && indev->ifa_list) {
ifa = indev->ifa_list;
newdst = ifa->ifa_local;
}
--
2.1.4
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
2015-11-06 12:44 [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check Pablo Neira Ayuso
@ 2015-11-06 17:08 ` Greg KH
2015-11-06 17:26 ` Pablo Neira Ayuso
0 siblings, 1 reply; 9+ messages in thread
From: Greg KH @ 2015-11-06 17:08 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, stable, Munehisa Kamata
On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
> From: Munehisa Kamata <kamatam@amazon.com>
>
> [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
This isn't a valid git commit id in Linus's tree :(
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
2015-11-06 17:08 ` Greg KH
@ 2015-11-06 17:26 ` Pablo Neira Ayuso
2016-01-18 19:27 ` Munehisa Kamata
0 siblings, 1 reply; 9+ messages in thread
From: Pablo Neira Ayuso @ 2015-11-06 17:26 UTC (permalink / raw)
To: Greg KH; +Cc: netfilter-devel, stable, Munehisa Kamata
On Fri, Nov 06, 2015 at 09:08:58AM -0800, Greg KH wrote:
> On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
> > From: Munehisa Kamata <kamatam@amazon.com>
> >
> > [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
>
> This isn't a valid git commit id in Linus's tree :(
This is David's tree already:
http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc
So this should hit Linus tree soon.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
2015-11-06 17:26 ` Pablo Neira Ayuso
@ 2016-01-18 19:27 ` Munehisa Kamata
2016-01-18 19:47 ` Pablo Neira Ayuso
0 siblings, 1 reply; 9+ messages in thread
From: Munehisa Kamata @ 2016-01-18 19:27 UTC (permalink / raw)
To: Pablo Neira Ayuso, Greg KH; +Cc: netfilter-devel, stable
Hi Greg,
This commit is already in Linus's tree. Could you please pick this up for 4.1.y?
Regards,
Munehisa
On 11/6/2015 9:26 AM, Pablo Neira Ayuso wrote:
> On Fri, Nov 06, 2015 at 09:08:58AM -0800, Greg KH wrote:
>> On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
>>> From: Munehisa Kamata <kamatam@amazon.com>
>>>
>>> [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
>>
>> This isn't a valid git commit id in Linus's tree :(
>
> This is David's tree already:
>
> http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc
>
> So this should hit Linus tree soon.
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
2016-01-18 19:27 ` Munehisa Kamata
@ 2016-01-18 19:47 ` Pablo Neira Ayuso
2016-01-18 19:48 ` Pablo Neira Ayuso
0 siblings, 1 reply; 9+ messages in thread
From: Pablo Neira Ayuso @ 2016-01-18 19:47 UTC (permalink / raw)
To: Munehisa Kamata; +Cc: Greg KH, netfilter-devel, stable
On Mon, Jan 18, 2016 at 11:27:13AM -0800, Munehisa Kamata wrote:
> Hi Greg,
>
> This commit is already in Linus's tree. Could you please pick this up for 4.1.y?
I submitted this twice... Last time I made it was this one:
http://patchwork.ozlabs.org/patch/544964/
Previous was rejected because it was not in Linus tree:
http://patchwork.ozlabs.org/patch/540946/
But the last attempt got no feedback...
> On 11/6/2015 9:26 AM, Pablo Neira Ayuso wrote:
> > On Fri, Nov 06, 2015 at 09:08:58AM -0800, Greg KH wrote:
> >> On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
> >>> From: Munehisa Kamata <kamatam@amazon.com>
> >>>
> >>> [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
> >>
> >> This isn't a valid git commit id in Linus's tree :(
> >
> > This is David's tree already:
> >
> > http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc
> >
> > So this should hit Linus tree soon.
> >
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
2016-01-18 19:47 ` Pablo Neira Ayuso
@ 2016-01-18 19:48 ` Pablo Neira Ayuso
2016-01-19 3:26 ` Greg KH
0 siblings, 1 reply; 9+ messages in thread
From: Pablo Neira Ayuso @ 2016-01-18 19:48 UTC (permalink / raw)
To: Munehisa Kamata; +Cc: Greg KH, netfilter-devel, stable
On Mon, Jan 18, 2016 at 08:47:18PM +0100, Pablo Neira Ayuso wrote:
> On Mon, Jan 18, 2016 at 11:27:13AM -0800, Munehisa Kamata wrote:
> > Hi Greg,
> >
> > This commit is already in Linus's tree. Could you please pick this up for 4.1.y?
>
> I submitted this twice... Last time I made it was this one:
>
> http://patchwork.ozlabs.org/patch/544964/
>
> Previous was rejected because it was not in Linus tree:
>
> http://patchwork.ozlabs.org/patch/540946/
>
> But the last attempt got no feedback...
BTW, you can find all my -stable submissions here:
http://patchwork.ozlabs.org/project/netfilter-devel/list/?state=*&q=stable-
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
2016-01-18 19:48 ` Pablo Neira Ayuso
@ 2016-01-19 3:26 ` Greg KH
0 siblings, 0 replies; 9+ messages in thread
From: Greg KH @ 2016-01-19 3:26 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: Munehisa Kamata, netfilter-devel, stable
On Mon, Jan 18, 2016 at 08:48:02PM +0100, Pablo Neira Ayuso wrote:
> On Mon, Jan 18, 2016 at 08:47:18PM +0100, Pablo Neira Ayuso wrote:
> > On Mon, Jan 18, 2016 at 11:27:13AM -0800, Munehisa Kamata wrote:
> > > Hi Greg,
> > >
> > > This commit is already in Linus's tree. Could you please pick this up for 4.1.y?
> >
> > I submitted this twice... Last time I made it was this one:
> >
> > http://patchwork.ozlabs.org/patch/544964/
> >
> > Previous was rejected because it was not in Linus tree:
> >
> > http://patchwork.ozlabs.org/patch/540946/
> >
> > But the last attempt got no feedback...
>
> BTW, you can find all my -stable submissions here:
>
> http://patchwork.ozlabs.org/project/netfilter-devel/list/?state=*&q=stable-
Relax, I am _way_ behind on stable patch work at the moment, should
hopefully dig out from the mess over the next week...
thanks,
greg k-h
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2016-01-19 3:26 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-11-16 11:00 [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check Pablo Neira Ayuso
2015-11-16 11:00 ` [PATCH -stable,4.3.y] netfilter: xt_TEE: fix NULL dereference Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2015-11-06 12:44 [PATCH -stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check Pablo Neira Ayuso
2015-11-06 17:08 ` Greg KH
2015-11-06 17:26 ` Pablo Neira Ayuso
2016-01-18 19:27 ` Munehisa Kamata
2016-01-18 19:47 ` Pablo Neira Ayuso
2016-01-18 19:48 ` Pablo Neira Ayuso
2016-01-19 3:26 ` Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.