Re: [PATCH 6.1 588/591] netfilter: nf_tables: prevent OOB access in nft_byteorder_eval

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Greg,

On Sun, Jul 16, 2023 at 09:52:07PM +0200, Greg Kroah-Hartman wrote:
> From: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx>
> 
> commit caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd upstream.

You can also cherry-pick this commit to:

- 5.15.y
- 5.10.y
- 5.4.y
- 4.19.y
- 4.14.y

Just tested here and it is good, no hunks are reported.

Thanks.

> When evaluating byteorder expressions with size 2, a union with 32-bit and
> 16-bit members is used. Since the 16-bit members are aligned to 32-bit,
> the array accesses will be out-of-bounds.
> 
> It may lead to a stack-out-of-bounds access like the one below:
> 
> [   23.095215] ==================================================================
> [   23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320
> [   23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115
> [   23.096358]
> [   23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413
> [   23.096770] Call Trace:
> [   23.096910]  <IRQ>
> [   23.097030]  dump_stack_lvl+0x60/0xc0
> [   23.097218]  print_report+0xcf/0x630
> [   23.097388]  ? nft_byteorder_eval+0x13c/0x320
> [   23.097577]  ? kasan_addr_to_slab+0xd/0xc0
> [   23.097760]  ? nft_byteorder_eval+0x13c/0x320
> [   23.097949]  kasan_report+0xc9/0x110
> [   23.098106]  ? nft_byteorder_eval+0x13c/0x320
> [   23.098298]  __asan_load2+0x83/0xd0
> [   23.098453]  nft_byteorder_eval+0x13c/0x320
> [   23.098659]  nft_do_chain+0x1c8/0xc50
> [   23.098852]  ? __pfx_nft_do_chain+0x10/0x10
> [   23.099078]  ? __kasan_check_read+0x11/0x20
> [   23.099295]  ? __pfx___lock_acquire+0x10/0x10
> [   23.099535]  ? __pfx___lock_acquire+0x10/0x10
> [   23.099745]  ? __kasan_check_read+0x11/0x20
> [   23.099929]  nft_do_chain_ipv4+0xfe/0x140
> [   23.100105]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
> [   23.100327]  ? lock_release+0x204/0x400
> [   23.100515]  ? nf_hook.constprop.0+0x340/0x550
> [   23.100779]  nf_hook_slow+0x6c/0x100
> [   23.100977]  ? __pfx_nft_do_chain_ipv4+0x10/0x10
> [   23.101223]  nf_hook.constprop.0+0x334/0x550
> [   23.101443]  ? __pfx_ip_local_deliver_finish+0x10/0x10
> [   23.101677]  ? __pfx_nf_hook.constprop.0+0x10/0x10
> [   23.101882]  ? __pfx_ip_rcv_finish+0x10/0x10
> [   23.102071]  ? __pfx_ip_local_deliver_finish+0x10/0x10
> [   23.102291]  ? rcu_read_lock_held+0x4b/0x70
> [   23.102481]  ip_local_deliver+0xbb/0x110
> [   23.102665]  ? __pfx_ip_rcv+0x10/0x10
> [   23.102839]  ip_rcv+0x199/0x2a0
> [   23.102980]  ? __pfx_ip_rcv+0x10/0x10
> [   23.103140]  __netif_receive_skb_one_core+0x13e/0x150
> [   23.103362]  ? __pfx___netif_receive_skb_one_core+0x10/0x10
> [   23.103647]  ? mark_held_locks+0x48/0xa0
> [   23.103819]  ? process_backlog+0x36c/0x380
> [   23.103999]  __netif_receive_skb+0x23/0xc0
> [   23.104179]  process_backlog+0x91/0x380
> [   23.104350]  __napi_poll.constprop.0+0x66/0x360
> [   23.104589]  ? net_rx_action+0x1cb/0x610
> [   23.104811]  net_rx_action+0x33e/0x610
> [   23.105024]  ? _raw_spin_unlock+0x23/0x50
> [   23.105257]  ? __pfx_net_rx_action+0x10/0x10
> [   23.105485]  ? mark_held_locks+0x48/0xa0
> [   23.105741]  __do_softirq+0xfa/0x5ab
> [   23.105956]  ? __dev_queue_xmit+0x765/0x1c00
> [   23.106193]  do_softirq.part.0+0x49/0xc0
> [   23.106423]  </IRQ>
> [   23.106547]  <TASK>
> [   23.106670]  __local_bh_enable_ip+0xf5/0x120
> [   23.106903]  __dev_queue_xmit+0x789/0x1c00
> [   23.107131]  ? __pfx___dev_queue_xmit+0x10/0x10
> [   23.107381]  ? find_held_lock+0x8e/0xb0
> [   23.107585]  ? lock_release+0x204/0x400
> [   23.107798]  ? neigh_resolve_output+0x185/0x350
> [   23.108049]  ? mark_held_locks+0x48/0xa0
> [   23.108265]  ? neigh_resolve_output+0x185/0x350
> [   23.108514]  neigh_resolve_output+0x246/0x350
> [   23.108753]  ? neigh_resolve_output+0x246/0x350
> [   23.109003]  ip_finish_output2+0x3c3/0x10b0
> [   23.109250]  ? __pfx_ip_finish_output2+0x10/0x10
> [   23.109510]  ? __pfx_nf_hook+0x10/0x10
> [   23.109732]  __ip_finish_output+0x217/0x390
> [   23.109978]  ip_finish_output+0x2f/0x130
> [   23.110207]  ip_output+0xc9/0x170
> [   23.110404]  ip_push_pending_frames+0x1a0/0x240
> [   23.110652]  raw_sendmsg+0x102e/0x19e0
> [   23.110871]  ? __pfx_raw_sendmsg+0x10/0x10
> [   23.111093]  ? lock_release+0x204/0x400
> [   23.111304]  ? __mod_lruvec_page_state+0x148/0x330
> [   23.111567]  ? find_held_lock+0x8e/0xb0
> [   23.111777]  ? find_held_lock+0x8e/0xb0
> [   23.111993]  ? __rcu_read_unlock+0x7c/0x2f0
> [   23.112225]  ? aa_sk_perm+0x18a/0x550
> [   23.112431]  ? filemap_map_pages+0x4f1/0x900
> [   23.112665]  ? __pfx_aa_sk_perm+0x10/0x10
> [   23.112880]  ? find_held_lock+0x8e/0xb0
> [   23.113098]  inet_sendmsg+0xa0/0xb0
> [   23.113297]  ? inet_sendmsg+0xa0/0xb0
> [   23.113500]  ? __pfx_inet_sendmsg+0x10/0x10
> [   23.113727]  sock_sendmsg+0xf4/0x100
> [   23.113924]  ? move_addr_to_kernel.part.0+0x4f/0xa0
> [   23.114190]  __sys_sendto+0x1d4/0x290
> [   23.114391]  ? __pfx___sys_sendto+0x10/0x10
> [   23.114621]  ? __pfx_mark_lock.part.0+0x10/0x10
> [   23.114869]  ? lock_release+0x204/0x400
> [   23.115076]  ? find_held_lock+0x8e/0xb0
> [   23.115287]  ? rcu_is_watching+0x23/0x60
> [   23.115503]  ? __rseq_handle_notify_resume+0x6e2/0x860
> [   23.115778]  ? __kasan_check_write+0x14/0x30
> [   23.116008]  ? blkcg_maybe_throttle_current+0x8d/0x770
> [   23.116285]  ? mark_held_locks+0x28/0xa0
> [   23.116503]  ? do_syscall_64+0x37/0x90
> [   23.116713]  __x64_sys_sendto+0x7f/0xb0
> [   23.116924]  do_syscall_64+0x59/0x90
> [   23.117123]  ? irqentry_exit_to_user_mode+0x25/0x30
> [   23.117387]  ? irqentry_exit+0x77/0xb0
> [   23.117593]  ? exc_page_fault+0x92/0x140
> [   23.117806]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
> [   23.118081] RIP: 0033:0x7f744aee2bba
> [   23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
> [   23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
> [   23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba
> [   23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003
> [   23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010
> [   23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
> [   23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0
> [   23.121617]  </TASK>
> [   23.121749]
> [   23.121845] The buggy address belongs to the virtual mapping at
> [   23.121845]  [ffffc90000000000, ffffc90000009000) created by:
> [   23.121845]  irq_init_percpu_irqstack+0x1cf/0x270
> [   23.122707]
> [   23.122803] The buggy address belongs to the physical page:
> [   23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09
> [   23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff)
> [   23.123998] page_type: 0xffffffff()
> [   23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000
> [   23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
> [   23.125023] page dumped because: kasan: bad access detected
> [   23.125326]
> [   23.125421] Memory state around the buggy address:
> [   23.125682]  ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [   23.126072]  ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00
> [   23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00
> [   23.126840]                                               ^
> [   23.127138]  ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3
> [   23.127522]  ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
> [   23.127906] ==================================================================
> [   23.128324] Disabling lock debugging due to kernel taint
> 
> Using simple s16 pointers for the 16-bit accesses fixes the problem. For
> the 32-bit accesses, src and dst can be used directly.
> 
> Fixes: 96518518cc41 ("netfilter: add nftables")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx>
> Reviewed-by: Florian Westphal <fw@xxxxxxxxx>
> Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  net/netfilter/nft_byteorder.c |   14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> --- a/net/netfilter/nft_byteorder.c
> +++ b/net/netfilter/nft_byteorder.c
> @@ -30,11 +30,11 @@ void nft_byteorder_eval(const struct nft
>  	const struct nft_byteorder *priv = nft_expr_priv(expr);
>  	u32 *src = &regs->data[priv->sreg];
>  	u32 *dst = &regs->data[priv->dreg];
> -	union { u32 u32; u16 u16; } *s, *d;
> +	u16 *s16, *d16;
>  	unsigned int i;
>  
> -	s = (void *)src;
> -	d = (void *)dst;
> +	s16 = (void *)src;
> +	d16 = (void *)dst;
>  
>  	switch (priv->size) {
>  	case 8: {
> @@ -62,11 +62,11 @@ void nft_byteorder_eval(const struct nft
>  		switch (priv->op) {
>  		case NFT_BYTEORDER_NTOH:
>  			for (i = 0; i < priv->len / 4; i++)
> -				d[i].u32 = ntohl((__force __be32)s[i].u32);
> +				dst[i] = ntohl((__force __be32)src[i]);
>  			break;
>  		case NFT_BYTEORDER_HTON:
>  			for (i = 0; i < priv->len / 4; i++)
> -				d[i].u32 = (__force __u32)htonl(s[i].u32);
> +				dst[i] = (__force __u32)htonl(src[i]);
>  			break;
>  		}
>  		break;
> @@ -74,11 +74,11 @@ void nft_byteorder_eval(const struct nft
>  		switch (priv->op) {
>  		case NFT_BYTEORDER_NTOH:
>  			for (i = 0; i < priv->len / 2; i++)
> -				d[i].u16 = ntohs((__force __be16)s[i].u16);
> +				d16[i] = ntohs((__force __be16)s16[i]);
>  			break;
>  		case NFT_BYTEORDER_HTON:
>  			for (i = 0; i < priv->len / 2; i++)
> -				d[i].u16 = (__force __u16)htons(s[i].u16);
> +				d16[i] = (__force __u16)htons(s16[i]);
>  			break;
>  		}
>  		break;
> 
> 



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux