netdev - Re: [PATCH v1 nf] netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240327140415.GH403975@kernel.org>
Date: Wed, 27 Mar 2024 14:04:15 +0000
From: Simon Horman <horms@...nel.org>
To: Kuniyuki Iwashima <kuniyu@...zon.com>
Cc: Pablo Neira Ayuso <pablo@...filter.org>,
	Jozsef Kadlecsik <kadlec@...filter.org>,
	Florian Westphal <fw@...len.de>,
	Kuniyuki Iwashima <kuni1840@...il.com>,
	netfilter-devel@...r.kernel.org, coreteam@...filter.org,
	netdev@...r.kernel.org, syzkaller <syzkaller@...glegroups.com>
Subject: Re: [PATCH v1 nf] netfilter: arptables: Select NETFILTER_FAMILY_ARP
 when building arp_tables.c

On Mon, Mar 25, 2024 at 09:15:52PM -0700, Kuniyuki Iwashima wrote:
> syzkaller started to report a warning below [0] after consuming the
> commit 4654467dc7e1 ("netfilter: arptables: allow xtables-nft only
> builds").
> 
> The change accidentally removed the dependency on NETFILTER_FAMILY_ARP
> from IP_NF_ARPTABLES.
> 
> If NF_TABLES_ARP is not enabled on Kconfig, NETFILTER_FAMILY_ARP will
> be removed and some code necessary for arptables will not be compiled.
> 
>   $ grep -E "(NETFILTER_FAMILY_ARP|IP_NF_ARPTABLES|NF_TABLES_ARP)" .config
>   CONFIG_NETFILTER_FAMILY_ARP=y
>   # CONFIG_NF_TABLES_ARP is not set
>   CONFIG_IP_NF_ARPTABLES=y
> 
>   $ make olddefconfig
> 
>   $ grep -E "(NETFILTER_FAMILY_ARP|IP_NF_ARPTABLES|NF_TABLES_ARP)" .config
>   # CONFIG_NF_TABLES_ARP is not set
>   CONFIG_IP_NF_ARPTABLES=y
> 
> So, when nf_register_net_hooks() is called for arptables, it will
> trigger the splat below.
> 
> Now IP_NF_ARPTABLES is only enabled by IP_NF_ARPFILTER, so let's
> restore the dependency on NETFILTER_FAMILY_ARP in IP_NF_ARPFILTER.

...

> Fixes: 4654467dc7e1 ("netfilter: arptables: allow xtables-nft only builds")
> Reported-by: syzkaller <syzkaller@...glegroups.com>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>

Reviewed-by: Simon Horman <horms@...nel.org>

...