netdev - [PATCH v1 0/4] iptables: Module unload causing NULL pointer reference.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200622171014.975-1-dwilder@us.ibm.com>
Date:   Mon, 22 Jun 2020 10:10:10 -0700
From:   David Wilder <dwilder@...ibm.com>
To:     netdev@...r.kernel.org
Cc:     netfilter-devel@...r.kernel.org, fw@...len.de, wilder@...ibm.com,
        mkubecek@...e.com
Subject: [PATCH v1 0/4] iptables: Module unload causing NULL pointer reference.

A crash happened on ppc64le when running ltp network tests triggered by "rmmod iptable_mangle".

See previous discussion in this thread: https://lists.openwall.net/netdev/2020/06/03/161 .

In the crash I found in iptable_mangle_hook() that state->net->ipv4.iptable_mangle=NULL causing a NULL pointer dereference. net->ipv4.iptable_mangle is set to NULL in iptable_mangle_net_exit() and called when ip_mangle modules is unloaded. A rmmod task was found running in the crash dump.  A 2nd crash showed the same problem when running "rmmod iptable_filter" (net->ipv4.iptable_filter=NULL).

To fix this I added .pre_exit hook in all iptable_foo.c. The pre_exit will un-register the underlying hook and exit would do the table freeing. The netns core does an unconditional synchronize_rcu after the pre_exit hooks insuring no packets are in flight that have picked up the pointer before completing the un-register.

These patches include changes for both iptables and ip6tables.

We tested this fix with ltp running iptables01.sh and iptables01.sh -6 a loop for 72 hours.

Signed-off-by: David Wilder <dwilder@...ibm.com>

David Wilder (4):
  netfilter: Split ipt_unregister_table() into pre_exit and exit
    helpers.
  netfilter: Add a .pre_exit hook in all iptable_foo.c.
  netfilter: Split ip6t_unregister_table() into pre_exit and exit
    helpers.
  netfilter: Add a .pre_exit hook in all ip6table_foo.c.

 include/linux/netfilter_ipv4/ip_tables.h  |  6 ++++++
 include/linux/netfilter_ipv6/ip6_tables.h |  3 +++
 net/ipv4/netfilter/ip_tables.c            | 15 ++++++++++++++-
 net/ipv4/netfilter/iptable_filter.c       | 10 +++++++++-
 net/ipv4/netfilter/iptable_mangle.c       | 10 +++++++++-
 net/ipv4/netfilter/iptable_nat.c          | 10 ++++++++--
 net/ipv4/netfilter/iptable_raw.c          | 10 +++++++++-
 net/ipv4/netfilter/iptable_security.c     | 11 +++++++++--
 net/ipv6/netfilter/ip6_tables.c           | 15 ++++++++++++++-
 net/ipv6/netfilter/ip6table_filter.c      | 10 +++++++++-
 net/ipv6/netfilter/ip6table_mangle.c      | 10 +++++++++-
 net/ipv6/netfilter/ip6table_nat.c         | 10 ++++++++--
 net/ipv6/netfilter/ip6table_raw.c         | 10 +++++++++-
 net/ipv6/netfilter/ip6table_security.c    | 10 +++++++++-
 14 files changed, 125 insertions(+), 15 deletions(-)

-- 
1.8.3.1