| From cfc2c740533368b96e2be5e0a4e8c3cace7d9814 Mon Sep 17 00:00:00 2001 |
| From: Eric Dumazet <edumazet@google.com> |
| Date: Fri, 16 Feb 2018 19:36:28 -0800 |
| Subject: netfilter: IDLETIMER: be syzkaller friendly |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| commit cfc2c740533368b96e2be5e0a4e8c3cace7d9814 upstream. |
| |
| We had one report from syzkaller [1] |
| |
| First issue is that INIT_WORK() should be done before mod_timer() |
| or we risk timer being fired too soon, even with a 1 second timer. |
| |
| Second issue is that we need to reject too big info->timeout |
| to avoid overflows in msecs_to_jiffies(info->timeout * 1000), or |
| risk looping, if result after overflow is 0. |
| |
| [1] |
| WARNING: CPU: 1 PID: 5129 at kernel/workqueue.c:1444 __queue_work+0xdf4/0x1230 kernel/workqueue.c:1444 |
| Kernel panic - not syncing: panic_on_warn set ... |
| |
| CPU: 1 PID: 5129 Comm: syzkaller159866 Not tainted 4.16.0-rc1+ #230 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| Call Trace: |
| <IRQ> |
| __dump_stack lib/dump_stack.c:17 [inline] |
| dump_stack+0x194/0x257 lib/dump_stack.c:53 |
| panic+0x1e4/0x41c kernel/panic.c:183 |
| __warn+0x1dc/0x200 kernel/panic.c:547 |
| report_bug+0x211/0x2d0 lib/bug.c:184 |
| fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178 |
| fixup_bug arch/x86/kernel/traps.c:247 [inline] |
| do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296 |
| do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315 |
| invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:988 |
| RIP: 0010:__queue_work+0xdf4/0x1230 kernel/workqueue.c:1444 |
| RSP: 0018:ffff8801db507538 EFLAGS: 00010006 |
| RAX: ffff8801aeb46080 RBX: ffff8801db530200 RCX: ffffffff81481404 |
| RDX: 0000000000000100 RSI: ffffffff86b42640 RDI: 0000000000000082 |
| RBP: ffff8801db507758 R08: 1ffff1003b6a0de5 R09: 000000000000000c |
| R10: ffff8801db5073f0 R11: 0000000000000020 R12: 1ffff1003b6a0eb6 |
| R13: ffff8801b1067ae0 R14: 00000000000001f8 R15: dffffc0000000000 |
| queue_work_on+0x16a/0x1c0 kernel/workqueue.c:1488 |
| queue_work include/linux/workqueue.h:488 [inline] |
| schedule_work include/linux/workqueue.h:546 [inline] |
| idletimer_tg_expired+0x44/0x60 net/netfilter/xt_IDLETIMER.c:116 |
| call_timer_fn+0x228/0x820 kernel/time/timer.c:1326 |
| expire_timers kernel/time/timer.c:1363 [inline] |
| __run_timers+0x7ee/0xb70 kernel/time/timer.c:1666 |
| run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692 |
| __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 |
| invoke_softirq kernel/softirq.c:365 [inline] |
| irq_exit+0x1cc/0x200 kernel/softirq.c:405 |
| exiting_irq arch/x86/include/asm/apic.h:541 [inline] |
| smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052 |
| apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:829 |
| </IRQ> |
| RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:777 [inline] |
| RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] |
| RIP: 0010:_raw_spin_unlock_irqrestore+0x5e/0xba kernel/locking/spinlock.c:184 |
| RSP: 0018:ffff8801c20173c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff12 |
| RAX: dffffc0000000000 RBX: 0000000000000282 RCX: 0000000000000006 |
| RDX: 1ffffffff0d592cd RSI: 1ffff10035d68d23 RDI: 0000000000000282 |
| RBP: ffff8801c20173d8 R08: 1ffff10038402e47 R09: 0000000000000000 |
| R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8820e5c8 |
| R13: ffff8801b1067ad8 R14: ffff8801aea7c268 R15: ffff8801aea7c278 |
| __debug_object_init+0x235/0x1040 lib/debugobjects.c:378 |
| debug_object_init+0x17/0x20 lib/debugobjects.c:391 |
| __init_work+0x2b/0x60 kernel/workqueue.c:506 |
| idletimer_tg_create net/netfilter/xt_IDLETIMER.c:152 [inline] |
| idletimer_tg_checkentry+0x691/0xb00 net/netfilter/xt_IDLETIMER.c:213 |
| xt_check_target+0x22c/0x7d0 net/netfilter/x_tables.c:850 |
| check_target net/ipv6/netfilter/ip6_tables.c:533 [inline] |
| find_check_entry.isra.7+0x935/0xcf0 net/ipv6/netfilter/ip6_tables.c:575 |
| translate_table+0xf52/0x1690 net/ipv6/netfilter/ip6_tables.c:744 |
| do_replace net/ipv6/netfilter/ip6_tables.c:1160 [inline] |
| do_ip6t_set_ctl+0x370/0x5f0 net/ipv6/netfilter/ip6_tables.c:1686 |
| nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] |
| nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 |
| ipv6_setsockopt+0x10b/0x130 net/ipv6/ipv6_sockglue.c:927 |
| udpv6_setsockopt+0x45/0x80 net/ipv6/udp.c:1422 |
| sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2976 |
| SYSC_setsockopt net/socket.c:1850 [inline] |
| SyS_setsockopt+0x189/0x360 net/socket.c:1829 |
| do_syscall_64+0x282/0x940 arch/x86/entry/common.c:287 |
| |
| Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzkaller <syzkaller@googlegroups.com> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/netfilter/xt_IDLETIMER.c | 9 ++++++--- |
| 1 file changed, 6 insertions(+), 3 deletions(-) |
| |
| --- a/net/netfilter/xt_IDLETIMER.c |
| +++ b/net/netfilter/xt_IDLETIMER.c |
| @@ -147,11 +147,11 @@ static int idletimer_tg_create(struct id |
| (unsigned long) info->timer); |
| info->timer->refcnt = 1; |
| |
| + INIT_WORK(&info->timer->work, idletimer_tg_work); |
| + |
| mod_timer(&info->timer->timer, |
| msecs_to_jiffies(info->timeout * 1000) + jiffies); |
| |
| - INIT_WORK(&info->timer->work, idletimer_tg_work); |
| - |
| return 0; |
| |
| out_free_attr: |
| @@ -192,7 +192,10 @@ static int idletimer_tg_checkentry(const |
| pr_debug("timeout value is zero\n"); |
| return -EINVAL; |
| } |
| - |
| + if (info->timeout >= INT_MAX / 1000) { |
| + pr_debug("timeout value is too big\n"); |
| + return -EINVAL; |
| + } |
| if (info->label[0] == '\0' || |
| strnlen(info->label, |
| MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) { |