Re: [PATCH v2] netfilter: xt_socket: Restore mark from full sockets only

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 2017-09-21 at 16:08 -0600, Subash Abhinov Kasiviswanathan wrote:
> An out of bounds error was detected on an ARM64 target with
> Android based kernel 4.9. This occurs while trying to
> restore mark on a skb from an inet request socket.
> 
> BUG: KASAN: slab-out-of-bounds in socket_match.isra.2+0xc8/0x1f0 net/netfilter/xt_socket.c:248
> Read of size 4 at addr ffffffc06a8d824c by task syz-fuzzer/1532
> CPU: 7 PID: 1532 Comm: syz-fuzzer Tainted: G        W  O    4.9.41+ #1
> Call trace:

> 
> v1->v2: Change socket_mt6_v1_v2_v3() as well as mentioned by Eric
> 
> Fixes: a94070000388 ("netfilter: xt_socket: prepare for TCP_NEW_SYN_RECV support")

When my commit was written (Mon Mar 16 21:06:17 2015 -0700), this
XT_SOCKET_RESTORESKMARK code was not there yet.


The bug was added in commit 01555e74bde5 ("netfilter: xt_socket: add
XT_SOCKET_RESTORESKMARK flag")  which came later (Mon Jun 15 18:40:43
2015 -0600)

Please put a correct Fixes: tag, thanks.


> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@xxxxxxxxxxxxxx>
> ---
>  net/netfilter/xt_socket.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
> index e75ef39..575d215 100644
> --- a/net/netfilter/xt_socket.c
> +++ b/net/netfilter/xt_socket.c
> @@ -76,7 +76,7 @@
>  			transparent = nf_sk_is_transparent(sk);
>  
>  		if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
> -		    transparent)
> +		    transparent && sk_fullsock(sk))
>  			pskb->mark = sk->sk_mark;
>  
>  		if (sk != skb->sk)
> @@ -133,7 +133,7 @@
>  			transparent = nf_sk_is_transparent(sk);
>  
>  		if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
> -		    transparent)
> +		    transparent && sk_fullsock(sk))
>  			pskb->mark = sk->sk_mark;
>  
>  		if (sk != skb->sk)


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux