From: Greg Kroah-Hartman Date: Thu, 5 Jul 2018 16:54:17 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.54~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d5bc72e9de791cbdba6ddb5363fe3e99eb2c971f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: netfilter-nf_tables-fix-null-ptr-in-nf_tables_dump_obj.patch --- diff --git a/queue-4.14/netfilter-nf_tables-fix-null-ptr-in-nf_tables_dump_obj.patch b/queue-4.14/netfilter-nf_tables-fix-null-ptr-in-nf_tables_dump_obj.patch new file mode 100644 index 00000000000..2d13ecca8fe --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-fix-null-ptr-in-nf_tables_dump_obj.patch @@ -0,0 +1,75 @@ +From 360cc79d9d299ce297b205508276285ceffc5fa8 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Tue, 29 May 2018 01:13:45 +0900 +Subject: netfilter: nf_tables: fix NULL-ptr in nf_tables_dump_obj() + +From: Taehee Yoo + +commit 360cc79d9d299ce297b205508276285ceffc5fa8 upstream. + +The table field in nft_obj_filter is not an array. In order to check +tablename, we should check if the pointer is set. + +Test commands: + + %nft add table ip filter + %nft add counter ip filter ct1 + %nft reset counters + +Splat looks like: + +[ 306.510504] kasan: CONFIG_KASAN_INLINE enabled +[ 306.516184] kasan: GPF could be caused by NULL-ptr deref or user memory access +[ 306.524775] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI +[ 306.528284] Modules linked in: nft_objref nft_counter nf_tables nfnetlink ip_tables x_tables +[ 306.528284] CPU: 0 PID: 1488 Comm: nft Not tainted 4.17.0-rc4+ #17 +[ 306.528284] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015 +[ 306.528284] RIP: 0010:nf_tables_dump_obj+0x52c/0xa70 [nf_tables] +[ 306.528284] RSP: 0018:ffff8800b6cb7520 EFLAGS: 00010246 +[ 306.528284] RAX: 0000000000000000 RBX: ffff8800b6c49820 RCX: 0000000000000000 +[ 306.528284] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffffed0016d96e9a +[ 306.528284] RBP: ffff8800b6cb75c0 R08: ffffed00236fce7c R09: ffffed00236fce7b +[ 306.528284] R10: ffffffff9f6241e8 R11: ffffed00236fce7c R12: ffff880111365108 +[ 306.528284] R13: 0000000000000000 R14: ffff8800b6c49860 R15: ffff8800b6c49860 +[ 306.528284] FS: 00007f838b007700(0000) GS:ffff88011b600000(0000) knlGS:0000000000000000 +[ 306.528284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 306.528284] CR2: 00007ffeafabcf78 CR3: 00000000b6cbe000 CR4: 00000000001006f0 +[ 306.528284] Call Trace: +[ 306.528284] netlink_dump+0x470/0xa20 +[ 306.528284] __netlink_dump_start+0x5ae/0x690 +[ 306.528284] ? nf_tables_getobj+0x1b3/0x740 [nf_tables] +[ 306.528284] nf_tables_getobj+0x2f5/0x740 [nf_tables] +[ 306.528284] ? nft_obj_notify+0x100/0x100 [nf_tables] +[ 306.528284] ? nf_tables_getobj+0x740/0x740 [nf_tables] +[ 306.528284] ? nf_tables_dump_flowtable_done+0x70/0x70 [nf_tables] +[ 306.528284] ? nft_obj_notify+0x100/0x100 [nf_tables] +[ 306.528284] nfnetlink_rcv_msg+0x8ff/0x932 [nfnetlink] +[ 306.528284] ? nfnetlink_rcv_msg+0x216/0x932 [nfnetlink] +[ 306.528284] netlink_rcv_skb+0x1c9/0x2f0 +[ 306.528284] ? nfnetlink_bind+0x1d0/0x1d0 [nfnetlink] +[ 306.528284] ? debug_check_no_locks_freed+0x270/0x270 +[ 306.528284] ? netlink_ack+0x7a0/0x7a0 +[ 306.528284] ? ns_capable_common+0x6e/0x110 +[ ... ] + +Fixes: e46abbcc05aa8 ("netfilter: nf_tables: Allow table names of up to 255 chars") +Signed-off-by: Taehee Yoo +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4614,7 +4614,7 @@ static int nf_tables_dump_obj(struct sk_ + if (idx > s_idx) + memset(&cb->args[1], 0, + sizeof(cb->args) - sizeof(cb->args[0])); +- if (filter && filter->table[0] && ++ if (filter && filter->table && + strcmp(filter->table, table->name)) + goto cont; + if (filter && diff --git a/queue-4.14/series b/queue-4.14/series index 095620f5ac9..5ad2728107b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -30,3 +30,4 @@ netfilter-nf_tables-disable-preemption-in-nft_update_chain_stats.patch netfilter-nf_tables-increase-nft_counters_enabled-in-nft_chain_stats_replace.patch netfilter-nf_tables-fix-memory-leak-on-error-exit-return.patch netfilter-nf_tables-add-missing-netlink-attrs-to-policies.patch +netfilter-nf_tables-fix-null-ptr-in-nf_tables_dump_obj.patch