* WARNING in nft_request_module @ 2020-01-16 0:25 syzbot 2020-01-16 8:06 ` [PATCH nf] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits Florian Westphal 2020-01-16 10:49 ` WARNING in nft_request_module syzbot 0 siblings, 2 replies; 4+ messages in thread From: syzbot @ 2020-01-16 0:25 UTC (permalink / raw) To: coreteam, davem, fw, kadlec, linux-kernel, netdev, netfilter-devel, pablo, syzkaller-bugs Hello, syzbot found the following crash on: HEAD commit: 51d69817 Merge tag 'platform-drivers-x86-v5.5-3' of git://.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17645c35e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=cfbb8fa33f49f9f3 dashboard link: https://syzkaller.appspot.com/bug?extid=0e63ae76d117ae1c3a01 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11123421e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15b873fee00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+0e63ae76d117ae1c3a01@syzkaller.appspotmail.com netlink: 760 bytes leftover after parsing attributes in process `syz-executor332'. ------------[ cut here ]------------ truncated: 'nft-expr-0-���LMMR�~�\x1e�*�{\x7f���F��\x17��\v\vDc�\x06�H�c\x16(\x16��?V\x1c�' (len 209) WARNING: CPU: 1 PID: 8621 at net/netfilter/nf_tables_api.c:588 nft_request_module+0x103/0x110 net/netfilter/nf_tables_api.c:588 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 8621 Comm: syz-executor332 Not tainted 5.5.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fb/0x318 lib/dump_stack.c:118 panic+0x264/0x7a9 kernel/panic.c:221 __warn+0x209/0x210 kernel/panic.c:582 report_bug+0x1b6/0x2f0 lib/bug.c:195 fixup_bug arch/x86/kernel/traps.c:174 [inline] do_error_trap+0xda/0x440 arch/x86/kernel/traps.c:267 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:286 invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 RIP: 0010:nft_request_module+0x103/0x110 net/netfilter/nf_tables_api.c:588 Code: 88 00 00 00 75 28 48 8d 65 f0 5b 41 5e 5d c3 e8 a3 3b e0 fa 48 8d 74 24 50 48 c7 c7 e0 ba e2 88 44 89 f2 31 c0 e8 ad 47 b2 fa <0f> 0b eb c5 e8 44 48 b2 fa 0f 1f 40 00 55 48 89 e5 41 57 41 56 41 RSP: 0018:ffffc90001ea75b0 EFLAGS: 00010246 RAX: a0c74c5486a24900 RBX: ffffffff89353700 RCX: ffff88808f06c1c0 RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000282 RBP: ffffc90001ea7650 R08: ffff88808f06ca18 R09: fffffbfff13cd132 R10: fffffbfff13cd132 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880a3f8f168 R14: 00000000000000d1 R15: ffffffff8936d1f0 nft_expr_type_request_module net/netfilter/nf_tables_api.c:2320 [inline] nft_expr_type_get net/netfilter/nf_tables_api.c:2345 [inline] nf_tables_expr_parse+0x308/0x9e0 net/netfilter/nf_tables_api.c:2420 nf_tables_newrule+0xefb/0x2d90 net/netfilter/nf_tables_api.c:3037 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:433 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:543 [inline] nfnetlink_rcv+0xecf/0x1e50 net/netfilter/nfnetlink.c:561 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x767/0x920 net/netlink/af_netlink.c:1328 netlink_sendmsg+0xa2c/0xd50 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:639 [inline] sock_sendmsg net/socket.c:659 [inline] ____sys_sendmsg+0x4f7/0x7f0 net/socket.c:2330 ___sys_sendmsg net/socket.c:2384 [inline] __sys_sendmsg+0x1ed/0x290 net/socket.c:2417 __do_sys_sendmsg net/socket.c:2426 [inline] __se_sys_sendmsg net/socket.c:2424 [inline] __x64_sys_sendmsg+0x7f/0x90 net/socket.c:2424 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x440619 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffeca951478 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440619 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 00000000006cb018 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000004002c8 R11: 0000000000000246 R12: 0000000000401ea0 R13: 0000000000401f30 R14: 0000000000000000 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds.. --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH nf] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits 2020-01-16 0:25 WARNING in nft_request_module syzbot @ 2020-01-16 8:06 ` Florian Westphal 2020-01-16 13:58 ` Pablo Neira Ayuso 2020-01-16 10:49 ` WARNING in nft_request_module syzbot 1 sibling, 1 reply; 4+ messages in thread From: Florian Westphal @ 2020-01-16 8:06 UTC (permalink / raw) To: netfilter-devel Cc: syzkaller-bugs, netdev, Florian Westphal, syzbot+0e63ae76d117ae1c3a01 This WARN can trigger because some of the names fed to the module autoload function can be of arbitrary length. Remove the WARN and add limits for all NLA_STRING attributes. Reported-by: syzbot+0e63ae76d117ae1c3a01@syzkaller.appspotmail.com Fixes: 452238e8d5ffd8 ("netfilter: nf_tables: add and use helper for module autoload") Signed-off-by: Florian Westphal <fw@strlen.de> --- net/netfilter/nf_tables_api.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 43f05b3acd60..5a1a6632e3a6 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -22,6 +22,8 @@ #include <net/net_namespace.h> #include <net/sock.h> +#define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-")) + static LIST_HEAD(nf_tables_expressions); static LIST_HEAD(nf_tables_objects); static LIST_HEAD(nf_tables_flowtables); @@ -585,7 +587,7 @@ static void nft_request_module(struct net *net, const char *fmt, ...) va_start(args, fmt); ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args); va_end(args); - if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret)) + if (ret >= MODULE_NAME_LEN) return; mutex_unlock(&net->nft.commit_mutex); @@ -1241,7 +1243,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { .len = NFT_CHAIN_MAXNAMELEN - 1 }, [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED }, [NFTA_CHAIN_POLICY] = { .type = NLA_U32 }, - [NFTA_CHAIN_TYPE] = { .type = NLA_STRING }, + [NFTA_CHAIN_TYPE] = { .type = NLA_STRING, + .len = NFT_MODULE_AUTOLOAD_LIMIT }, [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED }, [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 }, }; @@ -2355,7 +2358,8 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net, } static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = { - [NFTA_EXPR_NAME] = { .type = NLA_STRING }, + [NFTA_EXPR_NAME] = { .type = NLA_STRING, + .len = NFT_MODULE_AUTOLOAD_LIMIT }, [NFTA_EXPR_DATA] = { .type = NLA_NESTED }, }; @@ -4198,7 +4202,8 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, .len = NFT_USERDATA_MAXLEN }, [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, - [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING }, + [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING, + .len = NFT_OBJ_MAXNAMELEN - 1 }, }; static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { -- 2.24.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH nf] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits 2020-01-16 8:06 ` [PATCH nf] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits Florian Westphal @ 2020-01-16 13:58 ` Pablo Neira Ayuso 0 siblings, 0 replies; 4+ messages in thread From: Pablo Neira Ayuso @ 2020-01-16 13:58 UTC (permalink / raw) To: Florian Westphal Cc: netfilter-devel, syzkaller-bugs, netdev, syzbot+0e63ae76d117ae1c3a01 On Thu, Jan 16, 2020 at 09:06:50AM +0100, Florian Westphal wrote: > This WARN can trigger because some of the names fed to the module > autoload function can be of arbitrary length. > > Remove the WARN and add limits for all NLA_STRING attributes. Applied, thanks. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: WARNING in nft_request_module 2020-01-16 0:25 WARNING in nft_request_module syzbot 2020-01-16 8:06 ` [PATCH nf] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits Florian Westphal @ 2020-01-16 10:49 ` syzbot 1 sibling, 0 replies; 4+ messages in thread From: syzbot @ 2020-01-16 10:49 UTC (permalink / raw) To: coreteam, davem, fw, kadlec, kadlec, linux-kernel, netdev, netfilter-devel, pablo, syzkaller-bugs syzbot has bisected this bug to: commit 452238e8d5ffd8b77f92387519513839d4ca7379 Author: Florian Westphal <fw@strlen.de> Date: Wed Jul 11 11:45:10 2018 +0000 netfilter: nf_tables: add and use helper for module autoload bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17bb83e1e00000 start commit: 51d69817 Merge tag 'platform-drivers-x86-v5.5-3' of git://.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=147b83e1e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=107b83e1e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=d9290aeb7e6cf1c4 dashboard link: https://syzkaller.appspot.com/bug?extid=0e63ae76d117ae1c3a01 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b14421e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=138473fee00000 Reported-by: syzbot+0e63ae76d117ae1c3a01@syzkaller.appspotmail.com Fixes: 452238e8d5ff ("netfilter: nf_tables: add and use helper for module autoload") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-01-16 13:59 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-01-16 0:25 WARNING in nft_request_module syzbot 2020-01-16 8:06 ` [PATCH nf] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits Florian Westphal 2020-01-16 13:58 ` Pablo Neira Ayuso 2020-01-16 10:49 ` WARNING in nft_request_module syzbot
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.