netdev - Re: [PATCH] netfiler: ipset: fix unaligned atomic access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200622090625.GA1551@shell.armlinux.org.uk>
Date:   Mon, 22 Jun 2020 10:06:25 +0100
From:   Russell King - ARM Linux admin <linux@...linux.org.uk>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     coreteam@...filter.org, netfilter-devel@...r.kernel.org,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        Florian Westphal <fw@...len.de>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org
Subject: Re: [PATCH] netfiler: ipset: fix unaligned atomic access

On Mon, Jun 22, 2020 at 10:26:33AM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jun 10, 2020 at 09:51:11PM +0100, Russell King wrote:
> > When using ip_set with counters and comment, traffic causes the kernel
> > to panic on 32-bit ARM:
> > 
> > Alignment trap: not handling instruction e1b82f9f at [<bf01b0dc>]
> > Unhandled fault: alignment exception (0x221) at 0xea08133c
> > PC is at ip_set_match_extensions+0xe0/0x224 [ip_set]
> > 
> > The problem occurs when we try to update the 64-bit counters - the
> > faulting address above is not 64-bit aligned.  The problem occurs
> > due to the way elements are allocated, for example:
> > 
> > 	set->dsize = ip_set_elem_len(set, tb, 0, 0);
> > 	map = ip_set_alloc(sizeof(*map) + elements * set->dsize);
> > 
> > If the element has a requirement for a member to be 64-bit aligned,
> > and set->dsize is not a multiple of 8, but is a multiple of four,
> > then every odd numbered elements will be misaligned - and hitting
> > an atomic64_add() on that element will cause the kernel to panic.
> > 
> > ip_set_elem_len() must return a size that is rounded to the maximum
> > alignment of any extension field stored in the element.  This change
> > ensures that is the case.
> 
> Applied, thanks.

Thanks!

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!