netdev - Re: [BUG] crashes with kvm/nat networking and net-next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 12 May 2010 16:03:54 +0200
From:	Bart De Schuymer <bdschuym@...dora.be>
To:	Patrick McHardy <kaber@...sh.net>
CC:	Eric Dumazet <eric.dumazet@...il.com>,
	Stephen Hemminger <shemminger@...tta.com>,
	netdev@...r.kernel.org
Subject: Re: [BUG] crashes with kvm/nat networking and net-next

Patrick McHardy wrote:
> Eric Dumazet wrote:
>> Le mardi 11 mai 2010 à 20:25 -0700, Stephen Hemminger a écrit :
>>> This is a regression that is showing up now in net-next, not sure what
>>> changed recently in bridge netfilter that could be causing it?
>>>
>>> [ 4593.956206] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
>>> [ 4593.956219] IP: [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge]
>> Not sure, but br_nf_forward_ip() has following check :
>>
>> if (!skb->nf_bridge)
>> 	return NF_ACCEPT;
>>
>> while br_nf_forward_arp() missed this check ...
>>
>> So we can dereference null pointer later
> 
> That looks correct to me, offset 0x18 would be nf_bridge_info->mask.
> Bart, please review, thanks.
> 
>> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
>> index 93f80fe..cd2e5f5 100644
>> --- a/net/bridge/br_netfilter.c
>> +++ b/net/bridge/br_netfilter.c
>> @@ -723,6 +723,9 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
>>  		return NF_ACCEPT;
>>  #endif
>>  
>> +	if (!skb->nf_bridge)
>> +		return NF_ACCEPT;
>> +
>>  	if (skb->protocol != htons(ETH_P_ARP)) {
>>  		if (!IS_VLAN_ARP(skb))
>>  			return NF_ACCEPT;

That won't fix it since nf_bridge isn't used in the ARP case. The
correct fix is below. Does anyone know why the null pointer
dereference (skb->nf_bridge->mask & BRNF_8021Q) in
nf_bridge_update_protocol() didn't cause my uml kernel to crash??

cheers,
Bart


Don't call nf_bridge_update_protocol() for ARP traffic as
skb->nf_bridge isn't used in the ARP case.


Signed-off-by: Bart De Schuymer <bdschuym@...dora.be>
Reported-by: Stephen Hemminger <shemminger@...tta.com>

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 93f80fe..4442099 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb)
 			skb->pkt_type = PACKET_OTHERHOST;
 			nf_bridge->mask ^= BRNF_PKT_TYPE;
 		}
+		nf_bridge_update_protocol(skb);
 	} else {
 		in = *((struct net_device **)(skb->cb));
 	}
-	nf_bridge_update_protocol(skb);
 	nf_bridge_push_encap_header(skb);
 
 	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,

-- 
Bart De Schuymer
www.artinalgorithms.be
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html