[PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

[Pablo Neira Ayuso <pablo@netfilter.org>]

Xiang Mei says:

The OSF_WSS_MODULO branch in nf_osf_match_one() performs:

  ctx->window % f->wss.val

without guarding against f->wss.val == 0.  A user with CAP_NET_ADMIN
can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0
via nfnetlink.  When a matching TCP SYN packet arrives, the kernel
executes a division by zero and panics.

The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match
everything).  Apply the same semantics to OSF_WSS_MODULO: if val is 0,
any window value matches rather than dividing by zero.

Crash:
 Oops: divide error: 0000 [#1] SMP KASAN NOPTI
 RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
 Call Trace:
 <IRQ>
  nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))
  xt_osf_match_packet (net/netfilter/xt_osf.c:32)
  ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
  nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))
  ip_local_deliver (net/ipv4/ip_input.c:265)
  ip_rcv (include/linux/skbuff.h:1162)
  __netif_receive_skb_one_core (net/core/dev.c:6181)
  process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)
  __napi_poll (net/core/dev.c:7710)
  net_rx_action (net/core/dev.c:7945)
  handle_softirqs (kernel/softirq.c:622

Fix this from control plane, reject f->wss.val == 0 if wss.ws is
OSF_WSS_MODULO.

Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Apologies, I don't mean to step on your feet with this patch.
This just expedites scrutiny before PR submission.

 net/netfilter/nfnetlink_osf.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 5d15651c74f0..bf47a3812910 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -329,6 +329,15 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,
 		if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)
 			return -EINVAL;
 
+		switch (f->wss.wc) {
+		case OSF_WSS_MODULO:
+			if (f->wss.val == 0)
+				return -EINVAL;
+			break;
+		default:
+			break;
+		}
+
 		tot_opt_len += f->opt[i].length;
 		if (tot_opt_len > MAX_IPOPTLEN)
 			return -EINVAL;
-- 
2.47.3