On Thu, Jun 07, 2018 at 02:05:12AM +0900, Taehee Yoo wrote:
> The parameter this doesn't have a flags value. so that it can't be
> used by nft_rbtree_interval_end().
>
> test commands:
> %nft add table ip filter
> %nft add set ip filter s { type ipv4_addr \; flags interval \; }
> %nft add element ip filter s {0-1}
> %nft add element ip filter s {2-10}
> %nft add chain ip filter input { type filter hook input priority 0\; }
> %nft add rule ip filter input ip saddr @s
>
> Splat looks like:
> [ 246.752502] BUG: KASAN: slab-out-of-bounds in __nft_rbtree_lookup+0x677/0x6a0 [nft_set_rbtree]
> [ 246.752502] Read of size 1 at addr ffff88010d9efa47 by task http/1092
>
> [ 246.752502] CPU: 1 PID: 1092 Comm: http Not tainted 4.17.0-rc6+ #185
> [ 246.752502] Call Trace:
> [ 246.752502] <IRQ>
> [ 246.752502] dump_stack+0x74/0xbb
> [ 246.752502] ? __nft_rbtree_lookup+0x677/0x6a0 [nft_set_rbtree]
> [ 246.752502] print_address_description+0xc7/0x290
> [ 246.752502] ? __nft_rbtree_lookup+0x677/0x6a0 [nft_set_rbtree]
> [ 246.752502] kasan_report+0x22c/0x350
> [ 246.752502] __nft_rbtree_lookup+0x677/0x6a0 [nft_set_rbtree]
> [ 246.752502] nft_rbtree_lookup+0xc9/0x2d2 [nft_set_rbtree]
> [ 246.752502] ? sched_clock_cpu+0x144/0x180
> [ 246.752502] nft_lookup_eval+0x149/0x3a0 [nf_tables]
> [ 246.752502] ? __lock_acquire+0xcea/0x4ed0
> [ 246.752502] ? nft_lookup_init+0x6b0/0x6b0 [nf_tables]
> [ 246.752502] nft_do_chain+0x263/0xf50 [nf_tables]
> [ 246.752502] ? __nft_trace_packet+0x1a0/0x1a0 [nf_tables]
> [ 246.752502] ? sched_clock_cpu+0x144/0x180
> [ ... ]
Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
