linux-kernel - Re: [PATCH] netfilter: fix dangling pointer access of fake

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAN1Lvyo1CVopsB7iV=e-dAN9JDFg-SmQ8g6H6RrgD7qACAd4hQ@mail.gmail.com>
Date:   Mon, 22 Apr 2019 17:16:07 +0800
From:   Rundong Ge <rdong.ge@...il.com>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     kadlec@...ckhole.kfki.hu, fw@...len.de,
        Roopa Prabhu <roopa@...ulusnetworks.com>, davem@...emloft.net,
        netfilter-devel@...r.kernel.org, coreteam@...filter.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] netfilter: fix dangling pointer access of fake_rtable

br_nf_pre_routing will call the NF_INET_PRE_ROUTING hooks, at this
time both entry->state.in and entry->state.out are not bridge device.

NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb,
skb->dev, NULL,
br_nf_pre_routing_finish);

Pablo Neira Ayuso <pablo@...filter.org> 于2019年4月22日周一 下午4:34写道：
>
> On Tue, Apr 09, 2019 at 06:56:12AM +0000, Rundong Ge wrote:
> [...]
> > diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
> > index 0dcc359..57eb02d 100644
> > --- a/net/netfilter/nfnetlink_queue.c
> > +++ b/net/netfilter/nfnetlink_queue.c
> > @@ -905,13 +905,25 @@ static void free_entry(struct nf_queue_entry *entry)
> >  dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex)
> >  {
> >  #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
> > -     int physinif, physoutif;
> > +     struct net_device *physindev, *physoutdev;
> > +     struct net_bridge_port *port;
> >
> > -     physinif = nf_bridge_get_physinif(entry->skb);
> > -     physoutif = nf_bridge_get_physoutif(entry->skb);
> > -
> > -     if (physinif == ifindex || physoutif == ifindex)
> > -             return 1;
> > +     physindev = nf_bridge_get_physindev(entry->skb);
> > +     physoutdev = nf_bridge_get_physoutdev(entry->skb);
> > +     if (physindev) {
> > +             if (physindev->ifindex == ifindex)
> > +                     return 1;
> > +             port = br_port_get_rcu(physindev);
> > +             if (port && port->br->dev->ifindex == ifindex)
> > +                     return 1;
> > +     }
> > +     if (physoutdev) {
> > +             if (physoutdev->ifindex == ifindex)
> > +                     return 1;
> > +             port = br_port_get_rcu(physoutdev);
> > +             if (port && port->br->dev->ifindex == ifindex)
> > +                     return 1;
> > +     }
>
> Either entry->state.in and entry->state.out point to the bridge
> device, after this #endif.
>
> >  #endif
> >       if (entry->state.in)
> >               if (entry->state.in->ifindex == ifindex)
> > --
> > 1.8.3.1
> >