Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH nf-next] netfilter: nf_flow_table_offload: fix kernel NULL pointer dereference in nf_flow_table_indr_block_cb
@ 2020-03-18 10:52 wenxu
  2020-03-20 12:42 ` wenxu
  0 siblings, 1 reply; 4+ messages in thread
From: wenxu @ 2020-03-18 10:52 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel

From: wenxu <wenxu@ucloud.cn>

nf_flow_table_indr_block_cb will list net->nft.tables. But nf_flow_table
may load without nf_tables modules. So the list net->nft.tables may be
uinit.

[  630.908086] BUG: kernel NULL pointer dereference, address: 00000000000000f0
[  630.908233] #PF: error_code(0x0000) - not-present page
[  630.908304] PGD 800000104addd067 P4D 800000104addd067 PUD 104311d067 PMD 0
[  630.908380] Oops: 0000 [#1] SMP PTI [  630.908615] RIP: 0010:nf_flow_table_indr_block_cb+0xc0/0x190 [nf_flow_table]
[  630.908690] Code: 5b 41 5c 41 5d 41 5e 41 5f 5d c3 4c 89 75 a0 4c 89 65 a8 4d 89 ee 49 89 dd 4c 89 fe 48 c7 c7 b7 64 36 a0 31 c0 e8 ce ed d8 e0 <49> 8b b7 f0 00 00 00 48 c7 c7 c8 64      36 a0 31 c0 e8 b9 ed d8 e0 49[  630.908790] RSP: 0018:ffffc9000895f8c0 EFLAGS: 00010246
[  630.908860] RAX: 000000000000001d RBX: ffff888884788000 RCX: 0000000000000001
[  630.908935] RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffff88905fc18cc0
[  630.909010] RBP: ffffc9000895f920 R08: 00000000000005bc R09: 00000000000005bc
[  630.909084] R10: 0000000000000030 R11: ffffffff826ce604 R12: ffffffff823bdcc8
[  630.909159] R13: ffff888884788000 R14: ffffffff823bdc98 R15: 0000000000000000[  630.909234] FS:  00007f1d633e7740(0000) GS:ffff88905fc00000(0000) knlGS:0000000000000000[  630.909970] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  630.910372] CR2: 00000000000000f0 CR3: 000000103ad2e004 CR4: 00000000001606e0
[  630.910774] Call Trace:
[  630.911192]  ? mlx5e_rep_indr_setup_block+0x270/0x270 [mlx5_core]
[  630.911621]  ? mlx5e_rep_indr_setup_block+0x270/0x270 [mlx5_core]
[  630.912040]  ? mlx5e_rep_indr_setup_block+0x270/0x270 [mlx5_core]
[  630.912443]  flow_block_cmd+0x51/0x80
[  630.912844]  __flow_indr_block_cb_register+0x26c/0x510
[  630.913265]  mlx5e_nic_rep_netdevice_event+0x9e/0x110 [mlx5_core]
[  630.913665]  notifier_call_chain+0x53/0xa0
[  630.914063]  raw_notifier_call_chain+0x16/0x20
[  630.914466]  call_netdevice_notifiers_info+0x39/0x90
[  630.914859]  register_netdevice+0x484/0x550
[  630.915256]  __ip_tunnel_create+0x12b/0x1f0 [ip_tunnel]
[  630.915661]  ip_tunnel_init_net+0x116/0x180 [ip_tunnel]
[  630.916062]  ipgre_tap_init_net+0x22/0x30 [ip_gre]
[  630.916458]  ops_init+0x44/0x110
[  630.916851]  register_pernet_operations+0x112/0x200

Fixes: b5140a36da78 ("netfilter: flowtable: add indr block setup support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
 net/netfilter/nf_flow_table_offload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index ad54931..ca40dfa 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -1029,6 +1029,9 @@ static void nf_flow_table_indr_block_cb(struct net_device *dev,
 	struct nft_table *table;
 	struct nft_hook *hook;
 
+	if (!net->nft.base_seq)
+		return;
+
 	mutex_lock(&net->nft.commit_mutex);
 	list_for_each_entry(table, &net->nft.tables, list) {
 		list_for_each_entry(nft_ft, &table->flowtables, list) {
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH nf-next] netfilter: nf_flow_table_offload: fix kernel NULL pointer dereference in nf_flow_table_indr_block_cb
  2020-03-18 10:52 [PATCH nf-next] netfilter: nf_flow_table_offload: fix kernel NULL pointer dereference in nf_flow_table_indr_block_cb wenxu
@ 2020-03-20 12:42 ` wenxu
  2020-03-20 12:54   ` Pablo Neira Ayuso
  0 siblings, 1 reply; 4+ messages in thread
From: wenxu @ 2020-03-20 12:42 UTC (permalink / raw)
  To: pablo; +Cc: netfilter-devel

Hi Pablo,


How about this bugfix?   I see the status of this patch is accepted.

But it didn't apply to the master?


BR

wenxu

在 2020/3/18 18:52, wenxu@ucloud.cn 写道:
> From: wenxu <wenxu@ucloud.cn>
>
> nf_flow_table_indr_block_cb will list net->nft.tables. But nf_flow_table
> may load without nf_tables modules. So the list net->nft.tables may be
> uinit.
>
> [  630.908086] BUG: kernel NULL pointer dereference, address: 00000000000000f0
> [  630.908233] #PF: error_code(0x0000) - not-present page
> [  630.908304] PGD 800000104addd067 P4D 800000104addd067 PUD 104311d067 PMD 0
> [  630.908380] Oops: 0000 [#1] SMP PTI [  630.908615] RIP: 0010:nf_flow_table_indr_block_cb+0xc0/0x190 [nf_flow_table]
> [  630.908690] Code: 5b 41 5c 41 5d 41 5e 41 5f 5d c3 4c 89 75 a0 4c 89 65 a8 4d 89 ee 49 89 dd 4c 89 fe 48 c7 c7 b7 64 36 a0 31 c0 e8 ce ed d8 e0 <49> 8b b7 f0 00 00 00 48 c7 c7 c8 64      36 a0 31 c0 e8 b9 ed d8 e0 49[  630.908790] RSP: 0018:ffffc9000895f8c0 EFLAGS: 00010246
> [  630.908860] RAX: 000000000000001d RBX: ffff888884788000 RCX: 0000000000000001
> [  630.908935] RDX: 0000000000000000 RSI: 0000000000000086 RDI: ffff88905fc18cc0
> [  630.909010] RBP: ffffc9000895f920 R08: 00000000000005bc R09: 00000000000005bc
> [  630.909084] R10: 0000000000000030 R11: ffffffff826ce604 R12: ffffffff823bdcc8
> [  630.909159] R13: ffff888884788000 R14: ffffffff823bdc98 R15: 0000000000000000[  630.909234] FS:  00007f1d633e7740(0000) GS:ffff88905fc00000(0000) knlGS:0000000000000000[  630.909970] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  630.910372] CR2: 00000000000000f0 CR3: 000000103ad2e004 CR4: 00000000001606e0
> [  630.910774] Call Trace:
> [  630.911192]  ? mlx5e_rep_indr_setup_block+0x270/0x270 [mlx5_core]
> [  630.911621]  ? mlx5e_rep_indr_setup_block+0x270/0x270 [mlx5_core]
> [  630.912040]  ? mlx5e_rep_indr_setup_block+0x270/0x270 [mlx5_core]
> [  630.912443]  flow_block_cmd+0x51/0x80
> [  630.912844]  __flow_indr_block_cb_register+0x26c/0x510
> [  630.913265]  mlx5e_nic_rep_netdevice_event+0x9e/0x110 [mlx5_core]
> [  630.913665]  notifier_call_chain+0x53/0xa0
> [  630.914063]  raw_notifier_call_chain+0x16/0x20
> [  630.914466]  call_netdevice_notifiers_info+0x39/0x90
> [  630.914859]  register_netdevice+0x484/0x550
> [  630.915256]  __ip_tunnel_create+0x12b/0x1f0 [ip_tunnel]
> [  630.915661]  ip_tunnel_init_net+0x116/0x180 [ip_tunnel]
> [  630.916062]  ipgre_tap_init_net+0x22/0x30 [ip_gre]
> [  630.916458]  ops_init+0x44/0x110
> [  630.916851]  register_pernet_operations+0x112/0x200
>
> Fixes: b5140a36da78 ("netfilter: flowtable: add indr block setup support")
> Signed-off-by: wenxu <wenxu@ucloud.cn>
> ---
>   net/netfilter/nf_flow_table_offload.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
> index ad54931..ca40dfa 100644
> --- a/net/netfilter/nf_flow_table_offload.c
> +++ b/net/netfilter/nf_flow_table_offload.c
> @@ -1029,6 +1029,9 @@ static void nf_flow_table_indr_block_cb(struct net_device *dev,
>   	struct nft_table *table;
>   	struct nft_hook *hook;
>   
> +	if (!net->nft.base_seq)
> +		return;
> +
>   	mutex_lock(&net->nft.commit_mutex);
>   	list_for_each_entry(table, &net->nft.tables, list) {
>   		list_for_each_entry(nft_ft, &table->flowtables, list) {

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH nf-next] netfilter: nf_flow_table_offload: fix kernel NULL pointer dereference in nf_flow_table_indr_block_cb
  2020-03-20 12:42 ` wenxu
@ 2020-03-20 12:54   ` Pablo Neira Ayuso
  2020-03-28  0:58     ` wenxu
  0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2020-03-20 12:54 UTC (permalink / raw)
  To: wenxu; +Cc: netfilter-devel

On Fri, Mar 20, 2020 at 08:42:37PM +0800, wenxu wrote:
> Hi Pablo,
> 
> 
> How about this bugfix?   I see the status of this patch is accepted.
> 
> But it didn't apply to the master?

My mistake: back to "Under review" state.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH nf-next] netfilter: nf_flow_table_offload: fix kernel NULL pointer dereference in nf_flow_table_indr_block_cb
  2020-03-20 12:54   ` Pablo Neira Ayuso
@ 2020-03-28  0:58     ` wenxu
  0 siblings, 0 replies; 4+ messages in thread
From: wenxu @ 2020-03-28  0:58 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: netfilter-devel

Hi Pablo,


How about this crash fix?


BR

wenxu

在 2020/3/20 20:54, Pablo Neira Ayuso 写道:
> On Fri, Mar 20, 2020 at 08:42:37PM +0800, wenxu wrote:
>> Hi Pablo,
>>
>>
>> How about this bugfix?   I see the status of this patch is accepted.
>>
>> But it didn't apply to the master?
> My mistake: back to "Under review" state.
>

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-18 10:52 [PATCH nf-next] netfilter: nf_flow_table_offload: fix kernel NULL pointer dereference in nf_flow_table_indr_block_cb wenxu
2020-03-20 12:42 ` wenxu
2020-03-20 12:54   ` Pablo Neira Ayuso
2020-03-28  0:58     ` wenxu

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git