From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sergey Kvachonok <ravenexp@gmail.com>, Gao Feng <fgao@48lvckh6395k16k5.yundunddos.com>, Florian Westphal <fw@strlen.de>, Pablo Neira Ayuso <pablo@netfilter.org> Subject: [PATCH 4.12 78/99] netfilter: expect: fix crash when putting uninited expectation Date: Mon, 28 Aug 2017 10:05:16 +0200 [thread overview] Message-ID: <20170828080459.365428562@linuxfoundation.org> (raw) In-Reply-To: <20170828080455.968552605@linuxfoundation.org> 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal <fw@strlen.de> commit 36ac344e16e04e3e55e8fed7446095a6458c64e6 upstream. We crash in __nf_ct_expect_check, it calls nf_ct_remove_expect on the uninitialised expectation instead of existing one, so del_timer chokes on random memory address. Fixes: ec0e3f01114ad32711243 ("netfilter: nf_ct_expect: Add nf_ct_remove_expect()") Reported-by: Sergey Kvachonok <ravenexp@gmail.com> Tested-by: Sergey Kvachonok <ravenexp@gmail.com> Cc: Gao Feng <fgao@ikuai8.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/netfilter/nf_conntrack_expect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(s h = nf_ct_expect_dst_hash(net, &expect->tuple); hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) { if (expect_matches(i, expect)) { - if (nf_ct_remove_expect(expect)) + if (nf_ct_remove_expect(i)) break; } else if (expect_clash(i, expect)) { ret = -EBUSY;
WARNING: multiple messages have this Message-ID (diff)
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sergey Kvachonok <ravenexp@gmail.com>, Gao Feng <fgao@ikuai8.com>, Florian Westphal <fw@strlen.de>, Pablo Neira Ayuso <pablo@netfilter.org> Subject: [PATCH 4.12 78/99] netfilter: expect: fix crash when putting uninited expectation Date: Mon, 28 Aug 2017 10:05:16 +0200 [thread overview] Message-ID: <20170828080459.365428562@linuxfoundation.org> (raw) In-Reply-To: <20170828080455.968552605@linuxfoundation.org> 4.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal <fw@strlen.de> commit 36ac344e16e04e3e55e8fed7446095a6458c64e6 upstream. We crash in __nf_ct_expect_check, it calls nf_ct_remove_expect on the uninitialised expectation instead of existing one, so del_timer chokes on random memory address. Fixes: ec0e3f01114ad32711243 ("netfilter: nf_ct_expect: Add nf_ct_remove_expect()") Reported-by: Sergey Kvachonok <ravenexp@gmail.com> Tested-by: Sergey Kvachonok <ravenexp@gmail.com> Cc: Gao Feng <fgao@ikuai8.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/netfilter/nf_conntrack_expect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(s h = nf_ct_expect_dst_hash(net, &expect->tuple); hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) { if (expect_matches(i, expect)) { - if (nf_ct_remove_expect(expect)) + if (nf_ct_remove_expect(i)) break; } else if (expect_clash(i, expect)) { ret = -EBUSY;
next prev parent reply other threads:[~2017-08-28 9:01 UTC|newest] Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-08-28 8:03 [PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman 2017-08-28 8:03 ` [PATCH 4.12 01/99] sparc64: remove unnecessary log message Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 02/99] bonding: require speed/duplex only for 802.3ad, alb and tlb Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 03/99] bonding: ratelimit failed speed/duplex update warning Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 04/99] af_key: do not use GFP_KERNEL in atomic contexts Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 05/99] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 06/99] dccp: defer ccid_hc_tx_delete() at dismantle time Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 07/99] ipv4: fix NULL dereference in free_fib_info_rcu() Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 08/99] net_sched/sfq: update hierarchical backlog when drop packet Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 09/99] net_sched: remove warning from qdisc_hash_add Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 10/99] bpf: fix bpf_trace_printk on 32 bit archs Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 11/99] net: igmp: Use ingress interface rather than vrf device Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 12/99] openvswitch: fix skb_panic due to the incorrect actions attrlen Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 13/99] ptr_ring: use kmalloc_array() Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 14/99] ipv4: better IP_MAX_MTU enforcement Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 15/99] nfp: fix infinite loop on umapping cleanup Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 16/99] tun: handle register_netdevice() failures properly Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 17/99] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 18/99] tipc: fix use-after-free Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 19/99] ipv6: reset fn->rr_ptr when replacing route Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 20/99] ipv6: repair fib6 tree in failure case Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 21/99] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 22/99] net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 23/99] irda: do not leak initialized list.dev to userspace Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 24/99] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 25/99] net_sched: fix order of queue length updates in qdisc_replace() Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 26/99] bpf, verifier: add additional patterns to evaluate_reg_imm_alu Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 27/99] bpf: fix mixed signed/unsigned derived min/max value bounds Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 28/99] bpf/verifier: fix min/max handling in BPF_SUB Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 29/99] Input: trackpoint - add new trackpoint firmware ID Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 30/99] Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 31/99] Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 32/99] KVM: s390: sthyi: fix sthyi inline assembly Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 33/99] KVM: s390: sthyi: fix specification exception detection Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 34/99] KVM: x86: simplify handling of PKRU Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 35/99] KVM, pkeys: do not use PKRU value in vcpu->arch.guest_fpu.state Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 36/99] KVM: x86: block guest protection keys unless the host has them enabled Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 37/99] ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 38/99] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 39/99] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 40/99] ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 41/99] ALSA: firewire-motu: destroy stream data surely at failure of card initialization Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 42/99] ARCv2: SLC: Make sure busy bit is set properly for region ops Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 43/99] ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 44/99] ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 45/99] PM/hibernate: touch NMI watchdog when creating snapshot Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 46/99] mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 47/99] dax: fix deadlock due to misaligned PMD faults Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 48/99] i2c: designware: Fix system suspend Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 49/99] mm/madvise.c: fix freeing of locked page with MADV_FREE Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 50/99] fork: fix incorrect fput of ->exe_file causing use-after-free Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 51/99] mm/memblock.c: reversed logic in memblock_discard() Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 52/99] arm64: fpsimd: Prevent registers leaking across exec Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 53/99] drm: Fix framebuffer leak Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 55/99] drm/sun4i: Implement drm_driver lastclose to restore fbdev console Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 56/99] drm/atomic: Handle -EDEADLK with out-fences correctly Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 57/99] drm/atomic: If the atomic check fails, return its value first Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 59/99] drm/i915/gvt: Fix the kernel null pointer error Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 60/99] Revert "drm/amdgpu: fix vblank_time when displays are off" Greg Kroah-Hartman 2017-08-28 8:04 ` [PATCH 4.12 61/99] ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value() Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 62/99] tracing: Call clear_boot_tracer() at lateinit_sync Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 63/99] tracing: Missing error code in tracer_alloc_buffers() Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 64/99] tracing: Fix kmemleak in tracing_map_array_free() Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 65/99] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 66/99] RDMA/uverbs: Initialize cq_context appropriately Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 67/99] kbuild: linker script do not match C names unless LD_DEAD_CODE_DATA_ELIMINATION is configured Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 68/99] cifs: Fix df output for users with quota limits Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 69/99] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 70/99] nfsd: Limit end of page list when decoding NFSv4 WRITE Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 71/99] ring-buffer: Have ring_buffer_alloc_read_page() return error on offline CPU Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 72/99] virtio_pci: fix cpu affinity support Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 73/99] ftrace: Check for null ret_stack on profile function graph entry function Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 74/99] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 75/99] timers: Fix excessive granularity of new timers after a nohz idle Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 76/99] x86/mm: Fix use-after-free of ldt_struct Greg Kroah-Hartman 2017-08-28 8:05 ` Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 77/99] net: sunrpc: svcsock: fix NULL-pointer exception Greg Kroah-Hartman 2017-08-28 8:05 ` Greg Kroah-Hartman [this message] 2017-08-28 8:05 ` [PATCH 4.12 78/99] netfilter: expect: fix crash when putting uninited expectation Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 79/99] netfilter: nat: fix src map lookup Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 80/99] netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 81/99] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 82/99] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 83/99] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 84/99] Revert "android: binder: Sanity check at binder ioctl" Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 85/99] binder: use group leader instead of open thread Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 86/99] binder: Use wake up hint for synchronous transactions Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 87/99] ANDROID: binder: fix proc->tsk check Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 88/99] iio: imu: adis16480: Fix acceleration scale factor for adis16480 Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 89/99] iio: hid-sensor-trigger: Fix the race with user space powering up sensors Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 90/99] iio: magnetometer: st_magn: fix status register address for LSM303AGR Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 91/99] iio: magnetometer: st_magn: remove ihl property " Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 92/99] staging: rtl8188eu: add RNX-N150NUB support Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 93/99] iommu: Fix wrong freeing of iommu_device->dev Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 94/99] Clarify (and fix) MAX_LFS_FILESIZE macros Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 95/99] ntb: ntb_test: ensure the link is up before trying to configure the mws Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 96/99] ntb: transport shouldnt disable link due to bogus values in SPADs Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 97/99] ACPI: APD: Fix HID for Hisilicon Hip07/08 Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 98/99] ACPI: EC: Fix regression related to wrong ECDT initialization order Greg Kroah-Hartman 2017-08-28 8:05 ` [PATCH 4.12 99/99] powerpc/mm: Ensure cpumask update is ordered Greg Kroah-Hartman 2017-08-28 19:40 ` [PATCH 4.12 00/99] 4.12.10-stable review Shuah Khan 2017-08-29 4:56 ` Greg Kroah-Hartman 2017-08-29 0:11 ` Guenter Roeck 2017-08-29 4:56 ` Greg Kroah-Hartman
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170828080459.365428562@linuxfoundation.org \ --to=gregkh@linuxfoundation.org \ --cc=fgao@48lvckh6395k16k5.yundunddos.com \ --cc=fw@strlen.de \ --cc=linux-kernel@vger.kernel.org \ --cc=pablo@netfilter.org \ --cc=ravenexp@gmail.com \ --cc=stable@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.