From: Florian Westphal <fw@strlen.de>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf] netfilter: nf_tables: fix oob access
Date: Tue, 13 Dec 2016 21:22:25 +0100 [thread overview]
Message-ID: <20161213202225.GA11068@breakpoint.cc> (raw)
In-Reply-To: <20161213152904.GA2813@salvia>
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Tue, Dec 13, 2016 at 01:59:33PM +0100, Florian Westphal wrote:
> > BUG: KASAN: slab-out-of-bounds in nf_tables_rule_destroy+0xf1/0x130 at addr ffff88006a4c35c8
> > Read of size 8 by task nft/1607
> >
> > When we've destroyed last valid expr, nft_expr_next() returns an invalid expr.
> > We must not dereference it unless it passes != nft_expr_last() check.
> >
> > Signed-off-by: Florian Westphal <fw@strlen.de>
> > ---
> > I dislike nft_expr_last() naming, it doesn't return last
> > valid expression but an invalid address...
>
> Sure, send a patch for this, or simply update this oneliner in v2,
> your call. Thanks.
Ok, I will try to come up with a better name and send a patch once
next opens again. (what about rename to nft_expr_end()?)
prev parent reply other threads:[~2016-12-13 20:22 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-13 12:59 [PATCH nf] netfilter: nf_tables: fix oob access Florian Westphal
2016-12-13 15:29 ` Pablo Neira Ayuso
2016-12-13 20:22 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161213202225.GA11068@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.