From: Zubin Mithra <zsm@chromium.org>
To: stable@vger.kernel.org
Cc: groeck@chromium.org, gregkh@linuxfoundation.org,
pablo@netfilter.org, kadlec@blackhole.kfki.hu, fw@strlen.de,
sploving1@gmail.com
Subject: b301f2538759 ("netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES")
Date: Tue, 12 Mar 2019 11:07:53 -0700 [thread overview]
Message-ID: <20190312180752.GA162337@google.com> (raw)
Hello,
Syzkaller has triggered a stack OOB read when fuzzing a 4.4 kernel with the following stacktrace.
Call Trace:
[<ffffffff81cb9fad>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81cb9fad>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
[<ffffffff815275e9>] print_address_description mm/kasan/report.c:199 [inline]
[<ffffffff815275e9>] kasan_report_error mm/kasan/report.c:285 [inline]
[<ffffffff815275e9>] kasan_report.part.2.cold.3+0x447/0x4ec mm/kasan/report.c:310
[<ffffffff814eca2e>] kasan_report mm/kasan/report.c:328 [inline]
[<ffffffff814eca2e>] __asan_report_load1_noabort+0x2e/0x30 mm/kasan/report.c:328
[<ffffffff81cd54d1>] strnlen+0xc1/0xd0 lib/string.c:498
[<ffffffff81cdd6ac>] string.isra.4+0x4c/0x250 lib/vsprintf.c:518
[<ffffffff81ce27da>] vsnprintf+0x42a/0x18c0 lib/vsprintf.c:1904
[<ffffffff8114fd73>] __request_module+0x153/0x7a0 kernel/kmod.c:146
[<ffffffff82986521>] find_inlist_lock.constprop.15+0x111/0x210 net/bridge/netfilter/ebtables.c:347
[<ffffffff8298a942>] find_table_lock net/bridge/netfilter/ebtables.c:356 [inline]
[<ffffffff8298a942>] do_ebt_get_ctl+0x152/0x570 net/bridge/netfilter/ebtables.c:1531
[<ffffffff823e8bc5>] nf_sockopt net/netfilter/nf_sockopt.c:103 [inline]
[<ffffffff823e8bc5>] nf_getsockopt+0x75/0xd0 net/netfilter/nf_sockopt.c:121
[<ffffffff8261d60d>] ip_getsockopt+0x12d/0x170 net/ipv4/ip_sockglue.c:1533
[<ffffffff826411cd>] tcp_getsockopt+0x8d/0xe0 net/ipv4/tcp.c:3040
[<ffffffff82250c0f>] sock_common_getsockopt+0x9f/0xe0 net/core/sock.c:2652
[<ffffffff8224e45d>] SYSC_getsockopt net/socket.c:1811 [inline]
[<ffffffff8224e45d>] SyS_getsockopt+0x14d/0x230 net/socket.c:1793
[<ffffffff82a5f3cf>] tracesys_phase2+0x90/0x95
Could the following patch be applied to v4.4.y? The patch is present in v4.9.y.
* b301f2538759 ("netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES")
Tests run:
* Chrome OS tryjobs
* Syzkaller reproducer
Thanks,
- Zubin
next reply other threads:[~2019-03-12 18:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-12 18:07 Zubin Mithra [this message]
2019-03-12 18:58 ` b301f2538759 ("netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES") Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190312180752.GA162337@google.com \
--to=zsm@chromium.org \
--cc=fw@strlen.de \
--cc=gregkh@linuxfoundation.org \
--cc=groeck@chromium.org \
--cc=kadlec@blackhole.kfki.hu \
--cc=pablo@netfilter.org \
--cc=sploving1@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.