From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 14/15] netfilter: x_tables: initialise match/target check parameter struct
Date: Mon, 11 Jun 2018 11:22:32 +0200 [thread overview]
Message-ID: <20180611092233.3219-15-pablo@netfilter.org> (raw)
In-Reply-To: <20180611092233.3219-1-pablo@netfilter.org>
From: Florian Westphal <fw@strlen.de>
syzbot reports following splat:
BUG: KMSAN: uninit-value in ebt_stp_mt_check+0x24b/0x450
net/bridge/netfilter/ebt_stp.c:162
ebt_stp_mt_check+0x24b/0x450 net/bridge/netfilter/ebt_stp.c:162
xt_check_match+0x1438/0x1650 net/netfilter/x_tables.c:506
ebt_check_match net/bridge/netfilter/ebtables.c:372 [inline]
ebt_check_entry net/bridge/netfilter/ebtables.c:702 [inline]
The uninitialised access is
xt_mtchk_param->nft_compat
... which should be set to 0.
Fix it by zeroing the struct beforehand, same for tgchk.
ip(6)tables targetinfo uses c99-style initialiser, so no change
needed there.
Reported-by: syzbot+da4494182233c23a5fcf@syzkaller.appspotmail.com
Fixes: 55917a21d0cc0 ("netfilter: x_tables: add context to know if extension runs from nft_compat")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/bridge/netfilter/ebtables.c | 2 ++
net/ipv4/netfilter/ip_tables.c | 1 +
net/ipv6/netfilter/ip6_tables.c | 1 +
3 files changed, 4 insertions(+)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 08a65e4a77d0..ead123dab05e 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -700,6 +700,8 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
}
i = 0;
+ memset(&mtpar, 0, sizeof(mtpar));
+ memset(&tgpar, 0, sizeof(tgpar));
mtpar.net = tgpar.net = net;
mtpar.table = tgpar.table = name;
mtpar.entryinfo = tgpar.entryinfo = e;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index e85f35b89c49..f6130704f052 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -531,6 +531,7 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
return -ENOMEM;
j = 0;
+ memset(&mtpar, 0, sizeof(mtpar));
mtpar.net = net;
mtpar.table = name;
mtpar.entryinfo = &e->ip;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 97f79dc943d7..685c2168f524 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -551,6 +551,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
return -ENOMEM;
j = 0;
+ memset(&mtpar, 0, sizeof(mtpar));
mtpar.net = net;
mtpar.table = name;
mtpar.entryinfo = &e->ipv6;
--
2.11.0
next prev parent reply other threads:[~2018-06-11 9:22 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-11 9:22 [PATCH 00/15] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 01/15] netfilter: xt_CT: Reject the non-null terminated string from user space Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 02/15] netfilter: nf_tables: check msg_type before nft_trans_set(trans) Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 03/15] ipvs: register conntrack hooks for ftp Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 04/15] netfilter: nft_reject_bridge: fix skb allocation size in nft_reject_br_send_v6_unreach Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 05/15] ipvs: fix check on xmit to non-local addresses Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 06/15] netfilter: ebtables: fix compat entry padding Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 07/15] netfilter: xt_set: Check hook mask correctly Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 08/15] netfilter: ipset: List timing out entries with "timeout 1" instead of zero Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 09/15] netfilter: ipset: Limit max timeout value Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 10/15] netfilter: ipset: forbid family for hash:mac sets Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 11/15] netfilter: ebtables: reject non-bridge targets Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 12/15] netfilter: nft_set_rbtree: fix parameter of __nft_rbtree_lookup() Pablo Neira Ayuso
2018-06-11 9:22 ` [PATCH 13/15] netfilter: nf_conntrack: Increase __IPS_MAX_BIT with new bit IPS_OFFLOAD_BIT Pablo Neira Ayuso
2018-06-11 9:22 ` Pablo Neira Ayuso [this message]
2018-06-11 9:22 ` [PATCH 15/15] netfilter: remove include/net/netfilter/nft_dup.h Pablo Neira Ayuso
2018-06-11 23:31 ` [PATCH 00/15] Netfilter/IPVS fixes for net David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180611092233.3219-15-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).