netdev - Re: [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally generated fragments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181023220431.d6q22vhm7x6yjrot@breakpoint.cc>
Date:   Wed, 24 Oct 2018 00:04:31 +0200
From:   Florian Westphal <fw@...len.de>
To:     Maciej Żenczykowski <maze@...gle.com>
Cc:     Florian Westphal <fw@...len.de>, netfilter-devel@...r.kernel.org,
        Lorenzo Colitti <lorenzo@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Linux NetDev <netdev@...r.kernel.org>
Subject: Re: [PATCH nf] netfilter: ipv6: fix oops when defragmenting locally
 generated fragments

Maciej Żenczykowski <maze@...gle.com> wrote:
> >         ret = -EINPROGRESS;
> >         if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> > -           fq->q.meat == fq->q.len &&
> > -           nf_ct_frag6_reasm(fq, skb, dev))
> > -               ret = 0;
> > -       else
> > +           fq->q.meat == fq->q.len) {
> > +               unsigned long orefdst = skb->_skb_refdst;
> > +
> > +               skb->_skb_refdst = 0UL;
> > +               if (nf_ct_frag6_reasm(fq, skb, dev))
> > +                       ret = 0;
> > +               skb->_skb_refdst = orefdst;
> > +       } else {
> >                 skb_dst_drop(skb);
> > +       }
> >
> >  out_unlock:
> >         spin_unlock_bh(&fq->q.lock);
> > --
> > 2.18.1
> >
> 
> I don't quite follow how this fixes things, but I'll trust you on it.

The problematic spot is skb_morph() in nf_ct_frag6_reasm(), when we hit
this code path we take dst from a dst-less skb that got queued earlier.

> (nor do I understand why only 4.9 LTS appears to crash with a null ptr deref)

Newer kernels need nft or iptables rule that enables defrag, such as
"ip6tables -A INPUT -m conntrack --ctstate NEW"; 4.9 still enables it by
default.