From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: Re: [PATCH] netfilter: Can't fail and free after table replacement Date: Thu, 3 Apr 2014 23:37:57 +0200 Message-ID: <20140403213757.GA3834@localhost> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: bart.de.schuymer@pandora.be, kaber@trash.net, kadlec@blackhole.kfki.hu, stephen@networkplumber.org, netfilter-devel@vger.kernel.org, Florian Westphal To: Thomas Graf Return-path: Received: from mail.us.es ([193.147.175.20]:41633 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752870AbaDCViG (ORCPT ); Thu, 3 Apr 2014 17:38:06 -0400 Content-Disposition: inline In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: On Wed, Apr 02, 2014 at 05:35:13PM +0200, Thomas Graf wrote: > All xtables variants suffer from the defect that the copy_to_user() > to copy the counters to user memory may fail after the table has > already been exchanged and thus exposed. Return an error at this > point will result in freeing the already exposed table. Any > subsequent packet processing will result in a kernel panic. > > We can't copy the counters before exposing the new tables as we > want provide the counter state after the old table has been > unhooked. Therefore convert this into a silent error. > > Cc: Florian Westphal > Signed-off-by: Thomas Graf > --- > net/bridge/netfilter/ebtables.c | 4 +--- > net/ipv4/netfilter/arp_tables.c | 5 +++-- > net/ipv4/netfilter/ip_tables.c | 5 +++-- > net/ipv6/netfilter/ip6_tables.c | 5 +++-- > 4 files changed, 10 insertions(+), 9 deletions(-) > > diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c > index 0e474b1..7a3dc98 100644 > --- a/net/bridge/netfilter/ebtables.c > +++ b/net/bridge/netfilter/ebtables.c > @@ -1044,10 +1044,8 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl, > if (repl->num_counters && > copy_to_user(repl->counters, counterstmp, > repl->num_counters * sizeof(struct ebt_counter))) { > - ret = -EFAULT; > + /* Silent error, can't fail, new table is already in place */ > } > - else > - ret = 0; > This seems good to me. Perhaps we can spot a warning like in rtnetlink to inform the user that counters are not reliable anymore?