]>
Commit | Line | Data |
---|---|---|
d3c2d836 GKH |
1 | From 57ebd808a97d7c5b1e1afb937c2db22beba3c1f8 Mon Sep 17 00:00:00 2001 |
2 | From: Florian Westphal <fw@strlen.de> | |
3 | Date: Wed, 7 Feb 2018 13:46:25 +0100 | |
4 | Subject: netfilter: add back stackpointer size checks | |
5 | ||
6 | From: Florian Westphal <fw@strlen.de> | |
7 | ||
8 | commit 57ebd808a97d7c5b1e1afb937c2db22beba3c1f8 upstream. | |
9 | ||
10 | The rationale for removing the check is only correct for rulesets | |
11 | generated by ip(6)tables. | |
12 | ||
13 | In iptables, a jump can only occur to a user-defined chain, i.e. | |
14 | because we size the stack based on number of user-defined chains we | |
15 | cannot exceed stack size. | |
16 | ||
17 | However, the underlying binary format has no such restriction, | |
18 | and the validation step only ensures that the jump target is a | |
19 | valid rule start point. | |
20 | ||
21 | IOW, its possible to build a rule blob that has no user-defined | |
22 | chains but does contain a jump. | |
23 | ||
24 | If this happens, no jump stack gets allocated and crash occurs | |
25 | because no jumpstack was allocated. | |
26 | ||
27 | Fixes: 7814b6ec6d0d6 ("netfilter: xtables: don't save/restore jumpstack offset") | |
28 | Reported-by: syzbot+e783f671527912cd9403@syzkaller.appspotmail.com | |
29 | Signed-off-by: Florian Westphal <fw@strlen.de> | |
30 | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> | |
31 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
32 | ||
33 | --- | |
34 | net/ipv4/netfilter/arp_tables.c | 4 ++++ | |
35 | net/ipv4/netfilter/ip_tables.c | 7 ++++++- | |
36 | net/ipv6/netfilter/ip6_tables.c | 4 ++++ | |
37 | 3 files changed, 14 insertions(+), 1 deletion(-) | |
38 | ||
39 | --- a/net/ipv4/netfilter/arp_tables.c | |
40 | +++ b/net/ipv4/netfilter/arp_tables.c | |
41 | @@ -257,6 +257,10 @@ unsigned int arpt_do_table(struct sk_buf | |
42 | } | |
43 | if (table_base + v | |
44 | != arpt_next_entry(e)) { | |
45 | + if (unlikely(stackidx >= private->stacksize)) { | |
46 | + verdict = NF_DROP; | |
47 | + break; | |
48 | + } | |
49 | jumpstack[stackidx++] = e; | |
50 | } | |
51 | ||
52 | --- a/net/ipv4/netfilter/ip_tables.c | |
53 | +++ b/net/ipv4/netfilter/ip_tables.c | |
54 | @@ -335,8 +335,13 @@ ipt_do_table(struct sk_buff *skb, | |
55 | continue; | |
56 | } | |
57 | if (table_base + v != ipt_next_entry(e) && | |
58 | - !(e->ip.flags & IPT_F_GOTO)) | |
59 | + !(e->ip.flags & IPT_F_GOTO)) { | |
60 | + if (unlikely(stackidx >= private->stacksize)) { | |
61 | + verdict = NF_DROP; | |
62 | + break; | |
63 | + } | |
64 | jumpstack[stackidx++] = e; | |
65 | + } | |
66 | ||
67 | e = get_entry(table_base, v); | |
68 | continue; | |
69 | --- a/net/ipv6/netfilter/ip6_tables.c | |
70 | +++ b/net/ipv6/netfilter/ip6_tables.c | |
71 | @@ -357,6 +357,10 @@ ip6t_do_table(struct sk_buff *skb, | |
72 | } | |
73 | if (table_base + v != ip6t_next_entry(e) && | |
74 | !(e->ipv6.flags & IP6T_F_GOTO)) { | |
75 | + if (unlikely(stackidx >= private->stacksize)) { | |
76 | + verdict = NF_DROP; | |
77 | + break; | |
78 | + } | |
79 | jumpstack[stackidx++] = e; | |
80 | } | |
81 |