Re: [PATCH 3.14 21/29] netfilter: x_tables: validate targets of jumps

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Thu, Jun 23, 2016 at 11:13:47AM +0200, Florian Westphal wrote:
> Florian Westphal <fw@strlen.de> wrote:
> > Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> > > 3.14-stable review patch.  If anyone has any objections, please let me know.
> > 
> > I have -- this doesn't work in 3.14 as t->entries (the ruleset blob)
> > is still kept percpu.
> > 
> > > +static bool find_jump_target(const struct xt_table_info *t,
> > > +			     const struct arpt_entry *target)
> > > +{
> > > +	struct arpt_entry *iter;
> > > +
> > > +	xt_entry_foreach(iter, t->entries, t->size) {
> > 
> > 
> > .. so this causes in kernel soft lockup when I try to insert a rule.
> > 
> > I will go over the 3.14 stable queue and see if I can amend this to work
> > with 3.14.
> 
> This amended patch works for me (iptables-test.py passes except those
> tests that I expected to fail due to some missing features in 3.14).
> 
> I also briefly tried 32bit iptables/ip6tables and that seems happy
> as well.  The reproduces for the two bugs fail with -EINVAL.
> 
> ebtables doesn't work (even ebtables -A INPUT -j ACCEPT fails), but
> that should be solved by picking up
> d26e2c9ffa385dd1b646f43c1397ba12af9e, "Revert "netfilter: ensure number
> of counters is >0 in do_replace()" [ its a PARTIAL revert, so don't drop
> the original patch ... ]
> 
> Subject: netfilter: x_tables: validate targets of jumps
> 
> commit 36472341017529e2b12573093cc0f68719300997 upstream.
> 
> When we see a jump also check that the offset gets us to beginning of
> a rule (an ipt_entry).
> 
> The extra overhead is negible, even with absurd cases.
> 
> 300k custom rules, 300k jumps to 'next' user chain:
> [ plus one jump from INPUT to first userchain ]:
> 
> Before:
> real    0m24.874s
> user    0m7.532s
> sys     0m16.076s
> 
> After:
> real    0m27.464s
> user    0m7.436s
> sys     0m18.840s
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  Need to pass the start of the ruleset as extra argument as
>  t->entries won't work in 3.14 (its percpu and not even set
>  up for all processors at this point).

Thank you for the update, now applied.

greg k-h