* [lvc-project] [PATCH] netfilter: ebtables: remove unnecessary NULL check
@ 2023-06-20 15:25 Igor Artemiev
2023-06-20 16:38 ` Florian Westphal
0 siblings, 1 reply; 4+ messages in thread
From: Igor Artemiev @ 2023-06-20 15:25 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Igor Artemiev, Jozsef Kadlecsik, Florian Westphal,
David S . Miller, Paolo Abeni, Jakub Kicinski, netfilter-devel,
coreteam, netdev, linux-kernel, lvc-project
In ebt_do_table() 'private->chainstack' cannot be NULL
and the 'cs' pointer is dereferenced below, so it does not make
sense to compare 'private->chainstack' with NULL.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru>
---
net/bridge/netfilter/ebtables.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 757ec46fc45a..74daca8a5142 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -212,10 +212,7 @@ unsigned int ebt_do_table(void *priv, struct sk_buff *skb,
private = table->private;
cb_base = COUNTER_BASE(private->counters, private->nentries,
smp_processor_id());
- if (private->chainstack)
- cs = private->chainstack[smp_processor_id()];
- else
- cs = NULL;
+ cs = private->chainstack[smp_processor_id()];
chaininfo = private->hook_entry[hook];
nentries = private->hook_entry[hook]->nentries;
point = (struct ebt_entry *)(private->hook_entry[hook]->data);
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [lvc-project] [PATCH] netfilter: ebtables: remove unnecessary NULL check
2023-06-20 15:25 [lvc-project] [PATCH] netfilter: ebtables: remove unnecessary NULL check Igor Artemiev
@ 2023-06-20 16:38 ` Florian Westphal
2023-06-21 10:49 ` Igor A. Artemiev
0 siblings, 1 reply; 4+ messages in thread
From: Florian Westphal @ 2023-06-20 16:38 UTC (permalink / raw)
To: Igor Artemiev
Cc: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
David S . Miller, Paolo Abeni, Jakub Kicinski, netfilter-devel,
coreteam, netdev, linux-kernel, lvc-project
Igor Artemiev <Igor.A.Artemiev@mcst.ru> wrote:
> In ebt_do_table() 'private->chainstack' cannot be NULL
> and the 'cs' pointer is dereferenced below, so it does not make
> sense to compare 'private->chainstack' with NULL.
? Why do you think that?
> + cs = private->chainstack[smp_processor_id()];
Looks like NULL deref to me. Did you test this?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [lvc-project] [PATCH] netfilter: ebtables: remove unnecessary NULL check
2023-06-20 16:38 ` Florian Westphal
@ 2023-06-21 10:49 ` Igor A. Artemiev
2023-06-21 10:46 ` Florian Westphal
0 siblings, 1 reply; 4+ messages in thread
From: Igor A. Artemiev @ 2023-06-21 10:49 UTC (permalink / raw)
To: Florian Westphal
Cc: Pablo Neira Ayuso, Jozsef Kadlecsik, David S . Miller,
Paolo Abeni, Jakub Kicinski, netfilter-devel, coreteam, netdev,
linux-kernel, lvc-project
On 6/20/23 19:38, Florian Westphal wrote:
> Igor Artemiev <Igor.A.Artemiev@mcst.ru> wrote:
>> In ebt_do_table() 'private->chainstack' cannot be NULL
>> and the 'cs' pointer is dereferenced below, so it does not make
>> sense to compare 'private->chainstack' with NULL.
> ? Why do you think that?
>
The 'cs' pointer is dereferenced below without checking, as it is
assumed to always be initialized with
'private->chainstack[smp_processor_id()]'.
>> + cs = private->chainstack[smp_processor_id()];
> Looks like NULL deref to me. Did you test this?
>
No, I didn't test this.
Thanks,
Igor
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [lvc-project] [PATCH] netfilter: ebtables: remove unnecessary NULL check
2023-06-21 10:49 ` Igor A. Artemiev
@ 2023-06-21 10:46 ` Florian Westphal
0 siblings, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2023-06-21 10:46 UTC (permalink / raw)
To: Igor A. Artemiev
Cc: Florian Westphal, Pablo Neira Ayuso, Jozsef Kadlecsik,
David S . Miller, Paolo Abeni, Jakub Kicinski, netfilter-devel,
coreteam, netdev, linux-kernel, lvc-project
Igor A. Artemiev <Igor.A.Artemiev@mcst.ru> wrote:
> On 6/20/23 19:38, Florian Westphal wrote:
> > Igor Artemiev <Igor.A.Artemiev@mcst.ru> wrote:
> > > In ebt_do_table() 'private->chainstack' cannot be NULL
> > > and the 'cs' pointer is dereferenced below, so it does not make
> > > sense to compare 'private->chainstack' with NULL.
> > ? Why do you think that?
> >
> The 'cs' pointer is dereferenced below without checking, as it is assumed to
> always be initialized with 'private->chainstack[smp_processor_id()]'.
No, its not. The dereferencing is conditional, as is the allocation
of the chainstack.
No user defined chains, no chain stack.
With this change, "ebtables-legacy -A INPUT" causes kernel panic.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-06-21 10:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-06-20 15:25 [lvc-project] [PATCH] netfilter: ebtables: remove unnecessary NULL check Igor Artemiev
2023-06-20 16:38 ` Florian Westphal
2023-06-21 10:49 ` Igor A. Artemiev
2023-06-21 10:46 ` Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).