Subash Abhinov Kasiviswanathan <subashab@xxxxxxxxxxxxxx> wrote:
> skb_header_pointer will copy data into a buffer if data is non linear,
> otherwise it will return a pointer in the linear section of the data.
> nf_sk_lookup_slow_v{4,6} always copies data of size udphdr but later
> accesses memory within the size of tcphdr (th->doff) in case of TCP
> packets. This causes a crash when running with KASAN with the following
> call stack -
>
> BUG: KASAN: stack-out-of-bounds in xt_socket_lookup_slow_v4+0x524/0x718
> net/netfilter/xt_socket.c:178
> Read of size 2 at addr ffffffe3d417a87c by task syz-executor/28971
> CPU: 2 PID: 28971 Comm: syz-executor Tainted: G B W O 4.9.65+ #1
> Call trace:
> [<ffffff9467e8d390>] dump_backtrace+0x0/0x428 arch/arm64/kernel/traps.c:76
> [<ffffff9467e8d7e0>] show_stack+0x28/0x38 arch/arm64/kernel/traps.c:226
> [<ffffff946842d9b8>] __dump_stack lib/dump_stack.c:15 [inline]
> [<ffffff946842d9b8>] dump_stack+0xd4/0x124 lib/dump_stack.c:51
> [<ffffff946811d4b0>] print_address_description+0x68/0x258 mm/kasan/report.c:248
> [<ffffff946811d8c8>] kasan_report_error mm/kasan/report.c:347 [inline]
> [<ffffff946811d8c8>] kasan_report.part.2+0x228/0x2f0 mm/kasan/report.c:371
> [<ffffff946811df44>] kasan_report+0x5c/0x70 mm/kasan/report.c:372
> [<ffffff946811bebc>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
> [<ffffff946811bebc>] __asan_load2+0x84/0x98 mm/kasan/kasan.c:739
> [<ffffff94694d6f04>] __tcp_hdrlen include/linux/tcp.h:35 [inline]
> [<ffffff94694d6f04>] xt_socket_lookup_slow_v4+0x524/0x718 net/netfilter/xt_socket.c:178
>
> Fix this by copying data into appropriate size headers based on protocol.
Looks good to me, thanks.
> This crash was seen on a 4.9 based kernel, so the call stack is slightly
> different from current upstream code. xt_socket_lookup_slow_v{4,6} was replaced
> by nf_sk_lookup_slow_v4 on newer kernels after commit 8db4c5be88f6
> ("netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c")
>
> For older kernels, do I send a separate patch.
If you could that would be nice.
I think its best if you wait before the patch ends up in linus' tree so
you can reference the commit id from the backports commit message.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
