lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 050/389] netfilter: nf_tables: fix null deref due to zeroed list head
    Date
    From: Florian Westphal <fw@strlen.de>

    commit 580077855a40741cf511766129702d97ff02f4d9 upstream.

    In nf_tables_updtable, if nf_tables_table_enable returns an error,
    nft_trans_destroy is called to free the transaction object.

    nft_trans_destroy() calls list_del(), but the transaction was never
    placed on a list -- the list head is all zeroes, this results in
    a null dereference:

    BUG: KASAN: null-ptr-deref in nft_trans_destroy+0x26/0x59
    Call Trace:
    nft_trans_destroy+0x26/0x59
    nf_tables_newtable+0x4bc/0x9bc
    [..]

    Its sane to assume that nft_trans_destroy() can be called
    on the transaction object returned by nft_trans_alloc(), so
    make sure the list head is initialised.

    Fixes: 55dd6f93076b ("netfilter: nf_tables: use new transaction infrastructure to handle table")
    Reported-by: mingi cho <mgcho.minic@gmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/nf_tables_api.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -113,6 +113,7 @@ static struct nft_trans *nft_trans_alloc
    if (trans == NULL)
    return NULL;

    + INIT_LIST_HEAD(&trans->list);
    trans->msg_type = msg_type;
    trans->ctx = *ctx;


    \
     
     \ /
      Last update: 2022-08-23 13:14    [W:3.051 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site