netdev - Re: [PATCH] netfilter: ipset: Null pointer exception in ipset list:set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 16 Feb 2017 20:58:15 +0100 (CET)
From:   Jozsef Kadlecsik <kadlec@...ckhole.kfki.hu>
To:     Vishwanath Pai <vpai@...mai.com>
cc:     Pablo Neira Ayuso <pablo@...filter.org>,
        Patrick McHardy <kaber@...sh.net>, johunt@...mai.com,
        pai.vishwain@...il.com, netfilter-devel@...r.kernel.org,
        coreteam@...filter.org, netdev@...r.kernel.org
Subject: Re: [PATCH] netfilter: ipset: Null pointer exception in ipset
 list:set

Hi,

On Wed, 15 Feb 2017, Vishwanath Pai wrote:

> If we use before/after to add an element to an empty list it will cause
> a kernel panic.
> 
> $> cat crash.restore
> create a hash:ip
> create b hash:ip
> create test list:set timeout 5 size 4
> add test b before a
> 
> $> ipset -R < crash.restore
> 
> Executing the above will crash the kernel.
> 
> Signed-off-by: Vishwanath Pai <vpai@...mai.com>
> Reviewed-by: Josh Hunt <johunt@...mai.com>
> ---
>  net/netfilter/ipset/ip_set_list_set.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
> index 51077c5..178d4eb 100644
> --- a/net/netfilter/ipset/ip_set_list_set.c
> +++ b/net/netfilter/ipset/ip_set_list_set.c
> @@ -260,11 +260,14 @@ struct list_set {
>  		else
>  			prev = e;
>  	}
> +
> +	/* If before/after is used on an empty set */
> +	if ((d->before > 0 && !next) ||
> +	    (d->before < 0 && !prev))
> +		return -IPSET_ERR_REF_EXIST;
> +
>  	/* Re-add already existing element */
>  	if (n) {
> -		if ((d->before > 0 && !next) ||
> -		    (d->before < 0 && !prev))
> -			return -IPSET_ERR_REF_EXIST;
>  		if (!flag_exist)
>  			return -IPSET_ERR_EXIST;
>  		/* Update extensions */
> -- 
> 1.9.1

Patch is applied, thank you!

Best regards,
Jozsef
-
E-mail  : kadlec@...ckhole.kfki.hu, kadlecsik.jozsef@...ner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary