Re: [PATCH] netfilter: nft_socket: socket expressions for GID & UID

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 26.4.2022 1.34, Florian Westphal wrote:
Topi Miettinen <toiwoton@xxxxxxxxx> wrote:
On 20.4.2022 21.54, Topi Miettinen wrote:
Add socket expressions for checking GID or UID of the originating
socket. These work also on input side, unlike meta skuid/skgid.

Unfortunately, there's a reproducible kernel BUG when closing a local
connection:

Apr 25 21:18:13 kernel:
==================================================================
Apr 25 21:18:13 kernel: BUG: KASAN: null-ptr-deref in
nf_sk_lookup_slow_v6+0x45b/0x590 [nf_socket_ipv6]

You can pass this to scripts/faddr2line to get the location of the null deref.

Didn't work, but with grep and gdb I think I located the error to net/ipv6/netfilter/nf_socket_ipv6.c:

static struct sock *
nf_socket_get_sock_v6(struct net *net, struct sk_buff *skb, int doff,
                      const u8 protocol,
const struct in6_addr *saddr, const struct in6_addr *daddr,
                      const __be16 sport, const __be16 dport,
                      const struct net_device *in)
{
        switch (protocol) {
        case IPPROTO_TCP:
                return inet6_lookup(net, &tcp_hashinfo, skb, doff,
                                    saddr, sport, daddr, dport,
                                    in->ifindex);
                                    ^^^^^^^^^^^
where in->ifindex would be a NULL deref.

-Topi



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux