From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Qi Tang <tpluszz77@gmail.com>
Cc: Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org
Subject: Re: [PATCH] netfilter: ctnetlink: validate expect class against master helper
Date: Mon, 30 Mar 2026 13:53:32 +0200 [thread overview]
Message-ID: <acpkPEJRvzeY863Y@chamomile> (raw)
In-Reply-To: <20260329165131.240989-1-tpluszz77@gmail.com>
Hi,
On Mon, Mar 30, 2026 at 12:51:31AM +0800, Qi Tang wrote:
> ctnetlink_alloc_expect() validates CTA_EXPECT_CLASS against the
> helper specified by CTA_EXPECT_HELP_NAME. However,
> __nf_ct_expect_check() and nf_ct_expect_insert() later index the
> expect_policy array using the master conntrack's actual helper.
>
> When the supplied helper has a larger expect_class_max than the
> master's helper, the class passes validation but produces an
> out-of-bounds read on the master helper's heap-allocated policy
> array during expectation insertion.
>
> Validate the class against the master conntrack's own helper
> instead, since that is the helper whose policy array will actually
> be indexed.
>
> BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0
> Read of size 4 at addr ffff8880043fe408 by task poc/102
> Call Trace:
> nf_ct_expect_related_report+0x2479/0x27c0
> ctnetlink_create_expect+0x22b/0x3b0
> ctnetlink_new_expect+0x4bd/0x5c0
> nfnetlink_rcv_msg+0x67a/0x950
> netlink_rcv_skb+0x120/0x350
Better to ignore the helper name proposed by userspace when creating
the expectation.
The master conntrack must already has a helper, and such helper must
be the same that is specified here.
I could instead validate that exp->helper == nfct_help(master)->help->helper
but it is not worth, this fix simplifies this interface.
CTA_EXPECT_HELP_NAME still is used for dumping the name.
See:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260330115236.882409-1-pablo@netfilter.org/
prev parent reply other threads:[~2026-03-30 11:53 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-29 16:51 [PATCH] netfilter: ctnetlink: validate expect class against master helper Qi Tang
2026-03-30 11:53 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=acpkPEJRvzeY863Y@chamomile \
--to=pablo@netfilter.org \
--cc=coreteam@netfilter.org \
--cc=fw@strlen.de \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=phil@nwl.cc \
--cc=tpluszz77@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox