TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4d5f99ec00b7cfcdaabc39b016e2dddb2b762e7f
twx-linux/net/netfilter
T
History
Liping Zhang 1c759b361b netfilter: nf_tables: fix oops when inserting an element into a verdict map 
commit 58c78e104d upstream.

Dalegaard says:
 The following ruleset, when loaded with 'nft -f bad.txt'
 ----snip----
 flush ruleset
 table ip inlinenat {
   map sourcemap {
     type ipv4_addr : verdict;
   }

   chain postrouting {
     ip saddr vmap @sourcemap accept
   }
 }
 add chain inlinenat test
 add element inlinenat sourcemap { 100.123.10.2 : jump test }
 ----snip----

 results in a kernel oops:
 BUG: unable to handle kernel paging request at 0000000000001344
 IP: [<ffffffffa07bf704>] nf_tables_check_loops+0x114/0x1f0 [nf_tables]
 [...]
 Call Trace:
  [<ffffffffa07c2aae>] ? nft_data_init+0x13e/0x1a0 [nf_tables]
  [<ffffffffa07c1950>] nft_validate_register_store+0x60/0xb0 [nf_tables]
  [<ffffffffa07c74b5>] nft_add_set_elem+0x545/0x5e0 [nf_tables]
  [<ffffffffa07bfdd0>] ? nft_table_lookup+0x30/0x60 [nf_tables]
  [<ffffffff8132c630>] ? nla_strcmp+0x40/0x50
  [<ffffffffa07c766e>] nf_tables_newsetelem+0x11e/0x210 [nf_tables]
  [<ffffffff8132c400>] ? nla_validate+0x60/0x80
  [<ffffffffa030d9b4>] nfnetlink_rcv+0x354/0x5a7 [nfnetlink]

Because we forget to fill the net pointer in bind_ctx, so dereferencing
it may cause kernel crash.

Reported-by: Dalegaard <dalegaard@gmail.com>
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-01 09:46:40 +01:00
..
ipset
netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net
2018-11-27 16:08:00 +01:00
ipvs
ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()
2018-09-15 09:40:38 +02:00
core.c
…
Kconfig
…
Makefile
…
nf_conntrack_acct.c
…
nf_conntrack_amanda.c
…
nf_conntrack_broadcast.c
…
nf_conntrack_core.c
netfilter: restart search if moved to other chain
2018-01-31 12:06:10 +01:00
nf_conntrack_ecache.c
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
2017-10-08 10:14:19 +02:00
nf_conntrack_expect.c
netfilter: nf_ct_expect: remove the redundant slash when policy name is empty
2018-01-31 12:06:10 +01:00
nf_conntrack_extend.c
netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
2017-08-24 17:02:34 -07:00
nf_conntrack_ftp.c
…
nf_conntrack_h323_asn1.c
…
nf_conntrack_h323_main.c
…
nf_conntrack_h323_types.c
…
nf_conntrack_helper.c
…
nf_conntrack_irc.c
…
nf_conntrack_l3proto_generic.c
…
nf_conntrack_labels.c
…
nf_conntrack_netbios_ns.c
…
nf_conntrack_netlink.c
netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
2018-04-13 19:50:10 +02:00
nf_conntrack_pptp.c
…
nf_conntrack_proto_dccp.c
netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
2018-08-24 13:27:01 +02:00
nf_conntrack_proto_generic.c
…
nf_conntrack_proto_gre.c
…
nf_conntrack_proto_sctp.c
…
nf_conntrack_proto_tcp.c
…
nf_conntrack_proto_udp.c
…
nf_conntrack_proto_udplite.c
…
nf_conntrack_proto.c
…
nf_conntrack_sane.c
…
nf_conntrack_seqadj.c
…
nf_conntrack_sip.c
netfilter: nf_conntrack_sip: extend request line validation
2018-01-31 12:06:10 +01:00
nf_conntrack_snmp.c
…
nf_conntrack_standalone.c
…
nf_conntrack_tftp.c
…
nf_conntrack_timeout.c
…
nf_conntrack_timestamp.c
…
nf_internals.h
…
nf_log_common.c
…
nf_log.c
netfilter: nf_log: don't hold nf_log_mutex during user access
2018-07-11 16:03:51 +02:00
nf_nat_amanda.c
…
nf_nat_core.c
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
2017-10-08 10:14:19 +02:00
nf_nat_ftp.c
…
nf_nat_helper.c
…
nf_nat_irc.c
…
nf_nat_proto_common.c
netfilter: nat: cope with negative port range
2018-03-18 11:17:51 +01:00
nf_nat_proto_dccp.c
…
nf_nat_proto_sctp.c
…
nf_nat_proto_tcp.c
…
nf_nat_proto_udp.c
…
nf_nat_proto_udplite.c
…
nf_nat_proto_unknown.c
…
nf_nat_redirect.c
…
nf_nat_sip.c
…
nf_nat_tftp.c
…
nf_queue.c
netfilter: nf_queue: Make the queue_handler pernet
2018-02-16 20:09:40 +01:00
nf_sockopt.c
…
nf_synproxy_core.c
…
nf_tables_api.c
netfilter: nf_tables: fix oops when inserting an element into a verdict map
2018-12-01 09:46:40 +01:00
nf_tables_core.c
netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
2018-07-11 16:03:47 +02:00
nf_tables_inet.c
…
nf_tables_netdev.c
…
nfnetlink_acct.c
…
nfnetlink_cthelper.c
netfilter: nfnetlink_cthelper: Add missing permission checks
2018-01-31 12:06:11 +01:00
nfnetlink_cttimeout.c
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
2017-10-08 10:14:19 +02:00
nfnetlink_log.c
…
nfnetlink_queue.c
netfilter: nf_queue: augment nfqa_cfg_policy
2018-07-17 11:31:46 +02:00
nfnetlink.c
…
nft_bitwise.c
…
nft_byteorder.c
…
nft_cmp.c
…
nft_compat.c
…
nft_counter.c
…
nft_ct.c
…
nft_dynset.c
…
nft_exthdr.c
…
nft_hash.c
…
nft_immediate.c
…
nft_limit.c
…
nft_log.c
…
nft_lookup.c
…
nft_masq.c
…
nft_meta.c
netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family
2017-11-15 17:13:10 +01:00
nft_nat.c
…
nft_payload.c
…
nft_queue.c
netfilter: nft_queue: use raw_smp_processor_id()
2017-11-30 08:37:27 +00:00
nft_rbtree.c
…
nft_redir.c
…
nft_reject_inet.c
…
nft_reject.c
…
x_tables.c
netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user
2018-09-19 22:48:59 +02:00
xt_addrtype.c
…
xt_AUDIT.c
…
xt_bpf.c
…
xt_cgroup.c
…
xt_CHECKSUM.c
…
xt_CLASSIFY.c
…
xt_cluster.c
…
xt_comment.c
…
xt_connbytes.c
…
xt_connlabel.c
…
xt_connlimit.c
…
xt_connmark.c
…
xt_CONNSECMARK.c
…
xt_conntrack.c
…
xt_cpu.c
…
xt_CT.c
netfilter: xt_CT: fix refcnt leak on error path
2018-03-24 10:58:43 +01:00
xt_dccp.c
…
xt_devgroup.c
…
xt_dscp.c
…
xt_DSCP.c
…
xt_ecn.c
…
xt_esp.c
…
xt_hashlimit.c
netfilter: x_tables: add and use xt_check_proc_name
2018-04-08 11:51:59 +02:00
xt_helper.c
…
xt_hl.c
…
xt_HL.c
…
xt_HMARK.c
…
xt_IDLETIMER.c
netfilter: xt_IDLETIMER: add sysfs filename checking routine
2018-11-27 16:08:01 +01:00
xt_ipcomp.c
…
xt_iprange.c
…
xt_ipvs.c
…
xt_l2tp.c
…
xt_LED.c
netfilter: x_tables: fix missing timer initialization in xt_LED
2018-03-18 11:17:51 +01:00
xt_length.c
…
xt_limit.c
…
xt_LOG.c
…
xt_mac.c
…
xt_mark.c
…
xt_multiport.c
…
xt_nat.c
…
xt_NETMAP.c
…
xt_nfacct.c
…
xt_NFLOG.c
…
xt_NFQUEUE.c
…
xt_osf.c
netfilter: xt_osf: Add missing permission checks
2018-01-31 12:06:11 +01:00
xt_owner.c
…
xt_physdev.c
…
xt_pkttype.c
…
xt_policy.c
…
xt_quota.c
…
xt_rateest.c
…
xt_RATEEST.c
netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
2018-02-25 11:03:37 +01:00
xt_realm.c
…
xt_recent.c
netfilter: x_tables: add and use xt_check_proc_name
2018-04-08 11:51:59 +02:00
xt_REDIRECT.c
…
xt_repldata.h
…
xt_sctp.c
…
xt_SECMARK.c
…
xt_set.c
…
xt_socket.c
…
xt_state.c
…
xt_statistic.c
…
xt_string.c
…
xt_tcpmss.c
…
xt_TCPMSS.c
…
xt_TCPOPTSTRIP.c
…
xt_tcpudp.c
…
xt_TEE.c
…
xt_time.c
…
xt_TPROXY.c
…
xt_TRACE.c
…
xt_u32.c
…