[PATCH] netfilter: ctnetlink: validate expect class against master helper

[PATCH] netfilter: ctnetlink: validate expect class against master helper

[Qi Tang]

ctnetlink_alloc_expect() validates CTA_EXPECT_CLASS against the
helper specified by CTA_EXPECT_HELP_NAME.  However,
__nf_ct_expect_check() and nf_ct_expect_insert() later index the
expect_policy array using the master conntrack's actual helper.

When the supplied helper has a larger expect_class_max than the
master's helper, the class passes validation but produces an
out-of-bounds read on the master helper's heap-allocated policy
array during expectation insertion.

Validate the class against the master conntrack's own helper
instead, since that is the helper whose policy array will actually
be indexed.

  BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0
  Read of size 4 at addr ffff8880043fe408 by task poc/102
  Call Trace:
   nf_ct_expect_related_report+0x2479/0x27c0
   ctnetlink_create_expect+0x22b/0x3b0
   ctnetlink_new_expect+0x4bd/0x5c0
   nfnetlink_rcv_msg+0x67a/0x950
   netlink_rcv_skb+0x120/0x350

Fixes: b8c5e52c13ed ("netfilter: ctnetlink: allow to set expectation class")
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
---
 net/netfilter/nf_conntrack_netlink.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 3f408f3713bb..c57c665363e0 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3542,9 +3542,14 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct,
 	if (!help)
 		return ERR_PTR(-EOPNOTSUPP);
 
-	if (cda[CTA_EXPECT_CLASS] && helper) {
+	if (cda[CTA_EXPECT_CLASS]) {
+		struct nf_conntrack_helper *master_helper;
+
+		master_helper = rcu_dereference(help->helper);
+		if (!master_helper)
+			return ERR_PTR(-EOPNOTSUPP);
 		class = ntohl(nla_get_be32(cda[CTA_EXPECT_CLASS]));
-		if (class > helper->expect_class_max)
+		if (class > master_helper->expect_class_max)
 			return ERR_PTR(-EINVAL);
 	}
 	exp = nf_ct_expect_alloc(ct);
-- 
2.43.0

Re: [PATCH] netfilter: ctnetlink: validate expect class against master helper

[Pablo Neira Ayuso]

Hi,

On Mon, Mar 30, 2026 at 12:51:31AM +0800, Qi Tang wrote:
> ctnetlink_alloc_expect() validates CTA_EXPECT_CLASS against the
> helper specified by CTA_EXPECT_HELP_NAME.  However,
> __nf_ct_expect_check() and nf_ct_expect_insert() later index the
> expect_policy array using the master conntrack's actual helper.
> 
> When the supplied helper has a larger expect_class_max than the
> master's helper, the class passes validation but produces an
> out-of-bounds read on the master helper's heap-allocated policy
> array during expectation insertion.
> 
> Validate the class against the master conntrack's own helper
> instead, since that is the helper whose policy array will actually
> be indexed.
> 
>   BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0
>   Read of size 4 at addr ffff8880043fe408 by task poc/102
>   Call Trace:
>    nf_ct_expect_related_report+0x2479/0x27c0
>    ctnetlink_create_expect+0x22b/0x3b0
>    ctnetlink_new_expect+0x4bd/0x5c0
>    nfnetlink_rcv_msg+0x67a/0x950
>    netlink_rcv_skb+0x120/0x350

Better to ignore the helper name proposed by userspace when creating
the expectation.

The master conntrack must already has a helper, and such helper must
be the same that is specified here.

I could instead validate that exp->helper == nfct_help(master)->help->helper
but it is not worth, this fix simplifies this interface.

CTA_EXPECT_HELP_NAME still is used for dumping the name.

See:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260330115236.882409-1-pablo@netfilter.org/