| From fdd3ce82b449de71e97338c5f24a0f62c88f726e Mon Sep 17 00:00:00 2001 |
| From: Florian Westphal <fw@strlen.de> |
| Date: Wed, 8 Jan 2020 10:59:38 +0100 |
| Subject: [PATCH] netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is |
| present |
| |
| commit 22dad713b8a5ff488e07b821195270672f486eb2 upstream. |
| |
| The set uadt functions assume lineno is never NULL, but it is in |
| case of ip_set_utest(). |
| |
| syzkaller managed to generate a netlink message that calls this with |
| LINENO attr present: |
| |
| general protection fault: 0000 [#1] PREEMPT SMP KASAN |
| RIP: 0010:hash_mac4_uadt+0x1bc/0x470 net/netfilter/ipset/ip_set_hash_mac.c:104 |
| Call Trace: |
| ip_set_utest+0x55b/0x890 net/netfilter/ipset/ip_set_core.c:1867 |
| nfnetlink_rcv_msg+0xcf2/0xfb0 net/netfilter/nfnetlink.c:229 |
| netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 |
| nfnetlink_rcv+0x1ba/0x460 net/netfilter/nfnetlink.c:563 |
| |
| pass a dummy lineno storage, its easier than patching all set |
| implementations. |
| |
| This seems to be a day-0 bug. |
| |
| Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> |
| Reported-by: syzbot+34bd2369d38707f3f4a7@syzkaller.appspotmail.com |
| Fixes: a7b4f989a6294 ("netfilter: ipset: IP set core support") |
| Signed-off-by: Florian Westphal <fw@strlen.de> |
| Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c |
| index e11e18d5b6fb..a114dbef6345 100644 |
| --- a/net/netfilter/ipset/ip_set_core.c |
| +++ b/net/netfilter/ipset/ip_set_core.c |
| @@ -1691,6 +1691,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, |
| struct ip_set *set; |
| struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {}; |
| int ret = 0; |
| + u32 lineno; |
| |
| if (unlikely(protocol_min_failed(attr) || |
| !attr[IPSET_ATTR_SETNAME] || |
| @@ -1707,7 +1708,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, |
| return -IPSET_ERR_PROTOCOL; |
| |
| rcu_read_lock_bh(); |
| - ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0); |
| + ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0); |
| rcu_read_unlock_bh(); |
| /* Userspace can't trigger element to be re-added */ |
| if (ret == -EAGAIN) |
| -- |
| 2.7.4 |
| |
