[NETFILTER]: H.323 helper: fix use of uninitialized data

[NETFILTER]: H.323 helper: fix use of uninitialized data

[Patrick McHardy]

[-- Attachment #1: x2 --]
[-- Type: text/plain, Size: 3065 bytes --]

[NETFILTER]: H.323 helper: fix use of uninitialized data

When a Choice element contains an unsupported choice no error is returned
and parsing continues normally, but the choice value is not set and
contains data from the last parsed message. This may in turn lead to
parsing of more stale data and following crashes.

Fixes a crash triggered by testcase 0003243 from the PROTOS c07-h2250v4
testsuite following random other testcases:

CPU:    0
EIP:    0060:[<c01a9554>]    Not tainted VLI
EFLAGS: 00210646   (2.6.17-rc2 #3)
EIP is at memmove+0x19/0x22
eax: d7be0307   ebx: d7be0307   ecx: e841fcf9   edx: d7be0307
esi: bfffffff   edi: bfffffff   ebp: da5eb980   esp: c0347e2c
ds: 007b   es: 007b   ss: 0068
Process events/0 (pid: 4, threadinfo=c0347000 task=dff86a90)
Stack: <0>00000006 c0347ea6 d7be0301 e09a6b2c 00000006 da5eb980 d7be003e d7be0052
       c0347f6c e09a6d9c 00000006 c0347ea6 00000006 00000000 d7b9a548 00000000
       c0347f6c d7b9a548 00000004 e0a1a119 0000028f 00000006 c0347ea6 00000006
Call Trace:
 [<e09a6b2c>] mangle_contents+0x40/0xd8 [ip_nat]
 [<e09a6d9c>] ip_nat_mangle_tcp_packet+0xa1/0x191 [ip_nat]
 [<e0a1a119>] set_addr+0x60/0x14d [ip_nat_h323]
 [<e0ab6e66>] q931_help+0x2da/0x71a [ip_conntrack_h323]
 [<e0ab6e98>] q931_help+0x30c/0x71a [ip_conntrack_h323]
 [<e09af242>] ip_conntrack_help+0x22/0x2f [ip_conntrack]
 [<c022934a>] nf_iterate+0x2e/0x5f
 [<c025d357>] xfrm4_output_finish+0x0/0x39f
 [<c02294ce>] nf_hook_slow+0x42/0xb0
 [<c025d357>] xfrm4_output_finish+0x0/0x39f
 [<c025d732>] xfrm4_output+0x3c/0x4e
 [<c025d357>] xfrm4_output_finish+0x0/0x39f
 [<c0230370>] ip_forward+0x1c2/0x1fa
 [<c022f417>] ip_rcv+0x388/0x3b5
 [<c02188f9>] netif_receive_skb+0x2bc/0x2ec
 [<c0218994>] process_backlog+0x6b/0xd0
 [<c021675a>] net_rx_action+0x4b/0xb7
 [<c0115606>] __do_softirq+0x35/0x7d
 [<c0104294>] do_softirq+0x38/0x3f

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 462f3ddd384045c731b3268a1b9c91c834a5a68a
tree c32b3381fbfdb579e1a88f80b99a34a0a12aa060
parent 5074fd5f2344bc58355868c75c8abcd4145cde84
author Patrick McHardy <kaber@trash.net> Fri, 28 Apr 2006 15:56:05 +0200
committer Patrick McHardy <kaber@trash.net> Fri, 28 Apr 2006 15:56:05 +0200

 net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
index 491cd9b..355a53a 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
@@ -703,6 +703,10 @@ int decode_choice(bitstr_t * bs, field_t
 		type = get_bits(bs, f->sz);
 	}
 
+	/* Write Type */
+	if (base)
+		*(unsigned *) base = type;
+
 	/* Check Range */
 	if (type >= f->ub) {	/* Newer version? */
 		BYTE_ALIGN(bs);
@@ -712,10 +716,6 @@ int decode_choice(bitstr_t * bs, field_t
 		return H323_ERROR_NONE;
 	}
 
-	/* Write Type */
-	if (base)
-		*(unsigned *) base = type;
-
 	/* Transfer to son level */
 	son = &f->fields[type];
 	if (son->attr & STOP) {

Re: [NETFILTER]: H.323 helper: fix use of uninitialized data

[Jing Min Zhao]

I'll test it later.

----- Original Message ----- 
From: "Patrick McHardy" <kaber@trash.net>
To: "Jing Min Zhao" <zhaojingmin@hotmail.com>
Cc: <netfilter-devel@lists.netfilter.org>
Sent: Friday, April 28, 2006 12:52 PM
Subject: Re: [NETFILTER]: H.323 helper: fix use of uninitialized data


> Jing Min Zhao wrote:
>>>it should be enough to just make sure the container types have
>>>sane values about their content.
>>>
>> 
>> I agree with you and that's just what I thought when I was designing it.
> 
> Unfortunately it seems something is still buggy, I got a similar bug
> when running the testsuite in random mode.
> 
> 
> testcase 0001983
> User-SourceAddress-AliasAddress-E164-Value
> ee-empty, ee-8bit, ee-16bit, ee-overflow-binary 34
> 
> 
> BUG: unable to handle kernel paging request at virtual address bfffffff
> printing eip:
> c01a9554
> *pde = 1f674067
> *pte = 00000000
> Oops: 0000 [#1]
> PREEMPT
> Modules linked in: ip_nat_h323 ip_conntrack_h323 xfrm_user nfsd exportfs
> lockd sunrpc sch_sfq sch_red cls_fw sch_hfsc xt_length ipt_owner xt_MARK
> iptable_mangle pppoex
> CPU:    0
> EIP:    0060:[<c01a9554>]    Not tainted VLI
> EFLAGS: 00010646   (2.6.17-rc2 #3)
> EIP is at memmove+0x19/0x22
> eax: c77b2980   ebx: c77b2980   ecx: f884d680   edx: c77b2980
> esi: bfffffff   edi: bfffffff   ebp: ded0d780   esp: c0347e34
> ds: 007b   es: 007b   ss: 0068
> Process swapper (pid: 0, threadinfo=c0347000 task=c02d3880)
> Stack: <0>00000006 c0347eae c77b297a e09aeb2c 00000006 ded0d780 c77b283e
> c77b2852
>       c0347f6c e09aed9c 00000006 c0347eae 00000006 00000000 d2fb5af8
> 00000000
>       c0347f6c d2fb5af8 00000004 e0a18119 00000108 00000006 c0347eae
> 00000006
> Call Trace:
> [<e09aeb2c>] mangle_contents+0x40/0xd8 [ip_nat]
> [<e09aed9c>] ip_nat_mangle_tcp_packet+0xa1/0x191 [ip_nat]
> [<e0a18119>] set_addr+0x60/0x14d [ip_nat_h323]
> [<e0a9a42c>] DecodeQ931+0xab/0xd3 [ip_conntrack_h323]
> [<e0a98ab4>] q931_help+0x147/0x564 [ip_conntrack_h323]
> [<e0964242>] ip_conntrack_help+0x22/0x2f [ip_conntrack]
> [<c022934a>] nf_iterate+0x2e/0x5f
> [<c025d357>] xfrm4_output_finish+0x0/0x39f
> [<c02294ce>] nf_hook_slow+0x42/0xb0
> [<c025d357>] xfrm4_output_finish+0x0/0x39f
> [<c025d732>] xfrm4_output+0x3c/0x4e
> [<c025d357>] xfrm4_output_finish+0x0/0x39f
> [<c0230370>] ip_forward+0x1c2/0x1fa
> [<c022f417>] ip_rcv+0x388/0x3b5
> [<c02188f9>] netif_receive_skb+0x2bc/0x2ec
> [<c0218994>] process_backlog+0x6b/0xd0
> [<c021675a>] net_rx_action+0x4b/0xb7
> [<c0115606>] __do_softirq+0x35/0x7d
> [<c0104294>] do_softirq+0x38/0x3f
> =======================
> [<c011551d>] irq_exit+0x29/0x34
> [<c0104254>] do_IRQ+0x48/0x50
> [<c0102eaa>] common_interrupt+0x1a/0x20
> [<c0101542>] mwait_idle+0x1a/0x2e
> [<c010150a>] cpu_idle+0x40/0x5e
> [<c03205f4>] start_kernel+0x272/0x274
> Code: a5 89 d1 83 e1 03 74 02 f3 a4 89 d8 5a 59 5b 5e 5f c3 57 56 53 89
> c3 39 d0 73 07 e8 cb ff ff ff eb 0c 8d 74 0a ff 8d 7c 08 ff fd <f3> a4
> fc 89 d8 5b 5e 5f c3 57
> EIP: [<c01a9554>] memmove+0x19/0x22 SS:ESP 0068:c0347e34
> <0>Kernel panic - not syncing: Fatal exception in interrupt
> <0>Rebooting in 30 seconds..
>