releases/5.0.8/netfilter-nf_tables-use-after-free-in-dynamic-operat.patch

   1 From e4a8cca460c381539a5403d9434a5977c453fe0b Mon Sep 17 00:00:00 2001
   2 From: Pablo Neira Ayuso <pablo@netfilter.org>
   3 Date: Mon, 11 Mar 2019 13:04:16 +0100
   4 Subject: netfilter: nf_tables: use-after-free in dynamic operations
   5
   6 [ Upstream commit 3f3a390dbd59d236f62cff8e8b20355ef7069e3d ]
   7
   8 Smatch reports:
   9
  10        net/netfilter/nf_tables_api.c:2167 nf_tables_expr_destroy()
  11         error: dereferencing freed memory 'expr->ops'
  12
  13 net/netfilter/nf_tables_api.c
  14     2162 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
  15     2163                                   struct nft_expr *expr)
  16     2164 {
  17     2165        if (expr->ops->destroy)
  18     2166                expr->ops->destroy(ctx, expr);
  19                                                 ^^^^
  20 --> 2167        module_put(expr->ops->type->owner);
  21                            ^^^^^^^^^
  22     2168 }
  23
  24 Smatch says there are three functions which free expr->ops.
  25
  26 Fixes: b8e204006340 ("netfilter: nft_compat: use .release_ops and remove list of extension")
  27 Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
  28 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  29 Signed-off-by: Sasha Levin <sashal@kernel.org>
  30 ---
  31  net/netfilter/nf_tables_api.c | 4 +++-
  32  1 file changed, 3 insertions(+), 1 deletion(-)
  33
  34 diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
  35 index dc3670f2860e..f20b904873c6 100644
  36 --- a/net/netfilter/nf_tables_api.c
  37 +++ b/net/netfilter/nf_tables_api.c
  38 @@ -2119,9 +2119,11 @@ static int nf_tables_newexpr(const struct nft_ctx *ctx,
  39  static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
  40                                    struct nft_expr *expr)
  41  {
  42 +       const struct nft_expr_type *type = expr->ops->type;
  43 +
  44         if (expr->ops->destroy)
  45                 expr->ops->destroy(ctx, expr);
  46 -       module_put(expr->ops->type->owner);
  47 +       module_put(type->owner);
  48  }
  49
  50  struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
  51 --
  52 2.19.1
  53