linux-kernel - Re: [syzbot] [PATCH] Test for 6465e260f487

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00000000000052081e0609609d8e@google.com>
Date:   Sat, 04 Nov 2023 22:00:21 -0700
From:   syzbot <syzbot+de4025c006ec68ac56fc@...kaller.appspotmail.com>
To:     linux-kernel@...r.kernel.org
Subject: Re: [syzbot] [PATCH] Test for 6465e260f487

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: [PATCH] Test for 6465e260f487
Author: eadavis@...a.com

please test warn in __nf_unregister_net_hook

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 6465e260f487

diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 3126911f5042..fc1b337aec8f 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -117,7 +117,8 @@ nf_hook_entries_grow(const struct nf_hook_entries *old,
 		orig_ops = nf_hook_entries_get_hook_ops(old);
 
 		for (i = 0; i < old_entries; i++) {
-			if (orig_ops[i] != &dummy_ops)
+			if (!__kernel_text_address(orig_ops[i]) && 
+			    orig_ops[i] != &dummy_ops)
 				alloc_entries++;
 
 			/* Restrict BPF hook type to force a unique priority, not
@@ -146,7 +147,8 @@ nf_hook_entries_grow(const struct nf_hook_entries *old,
 	i = 0;
 	nhooks = 0;
 	while (i < old_entries) {
-		if (orig_ops[i] == &dummy_ops) {
+		if (__kernel_text_address(orig_ops[i]) || 
+		    orig_ops[i] == &dummy_ops) {
 			++i;
 			continue;
 		}
@@ -263,10 +265,12 @@ static void *__nf_hook_entries_try_shrink(struct nf_hook_entries *old,
 
 	new_ops = nf_hook_entries_get_hook_ops(new);
 	for (i = 0, j = 0; i < old->num_hook_entries; i++) {
-		if (orig_ops[i] == &dummy_ops)
+		if (IS_ERR_OR_NULL(orig_ops[i]) || orig_ops[i] == &dummy_ops)
 			continue;
 		new->hooks[j] = old->hooks[i];
 		new_ops[j] = (void *)orig_ops[i];
+		printk("new ents: %p, new uo h: %p, new ops: %p, %s\n",
+			new, new->hooks[j], new_ops[j], __func__);
 		j++;
 	}
 	hooks_validate(new);
@@ -479,6 +483,7 @@ static bool nf_remove_net_hook(struct nf_hook_entries *old,
 			continue;
 		WRITE_ONCE(old->hooks[i].hook, accept_all);
 		WRITE_ONCE(orig_ops[i], (void *)&dummy_ops);
+		printk("ents: %p, deled ops: %p, i: %d, %s\n", old, orig_ops[i], i, __func__);
 		return true;
 	}