[PATCH net 07/15] ipvs: ftp: add seqadj extension before linking the expectation

[Pablo Neira Ayuso <pablo@netfilter.org>]

From: Theodor Arsenij Larionov Trichkine <theodorlarionov@gmail.com>

ip_vs_ftp_out() links an expectation into the helper extension of the
conntrack, then ip_vs_update_conntrack() adds the seqadj extension. If
the conntrack is still unconfirmed, which happens when the real server's
reply does not match an existing conntrack and creates a new one,
krealloc() can move ct->ext and the expectation list keeps pointing into
the freed area. Deleting the conntrack then writes to it:

  BUG: KASAN: slab-use-after-free in nf_ct_unlink_expect_report+0x490/0x4c0
  Write of size 8 at addr ffff888004dd4e48 by task syz.2.17/649

Reachable with CAP_NET_ADMIN in a user namespace.

Add the seqadj extension before mangling, so it is in place before the
expectation is linked.

Fixes: b25adce16064 ("ipvs: correct usage/allocation of seqadj ext in ipvs")
Cc: stable@vger.kernel.org
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Theodor Arsenij Larionov Trichkine <theodorlarionov@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/ipvs/ip_vs_ftp.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 44de99f4d187..81c3a2fd27b3 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -29,6 +29,7 @@
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <linux/gfp.h>
@@ -384,19 +385,25 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
 
 	ct = nf_ct_get(skb, &ctinfo);
 	if (ct && !nf_ct_is_template(ct)) {
-		bool mangled;
+		bool mangled = false;
 
 		/* If mangling fails this function will return 0
 		 * which will cause the packet to be dropped.
 		 * Mangling can only fail under memory pressure,
 		 * hopefully it will succeed on the retransmitted
 		 * packet.
+		 *
+		 * Add the seqadj extension before the expectation is
+		 * linked into the helper extension: adding it later
+		 * reallocates ct->ext under the expectation list.
 		 */
-		mangled = nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
-						   ipvsh->len,
-						   start - data,
-						   end - start,
-						   buf, buf_len);
+		if (nf_ct_is_confirmed(ct) || nfct_seqadj(ct) ||
+		    nfct_seqadj_ext_add(ct))
+			mangled = nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+							   ipvsh->len,
+							   start - data,
+							   end - start,
+							   buf, buf_len);
 		if (mangled) {
 			ip_vs_nfct_expect_related(skb, ct, n_cp,
 						  ipvsh->protocol, 0, 0);
-- 
2.47.3