Re: [PATCH nf v2] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 4/15/26 12:14 AM, Xiang Mei wrote:
> nf_osf_match_one() computes ctx->window % f->wss.val in the
> OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A
> CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a
> subsequent matching TCP SYN divides by zero and panics the kernel.
> 
> Reject the bogus fingerprint in nfnl_osf_add_callback() above the
> per-option for-loop. f->wss is per-fingerprint, not per-option, so
> the check must run regardless of f->opt_num (including 0). Also
> reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that
> as "should not happen".
> 
> Crash:
>   Oops: divide error: 0000 [#1] SMP KASAN NOPTI
>   RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
>   Call Trace:
>   <IRQ>
>    nf_osf_match (net/netfilter/nfnetlink_osf.c:220)
>    xt_osf_match_packet (net/netfilter/xt_osf.c:32)
>    ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
>    nf_hook_slow (net/netfilter/core.c:622)
>    ip_local_deliver (net/ipv4/ip_input.c:265)
>    ip_rcv (include/linux/skbuff.h:1162)
>    __netif_receive_skb_one_core (net/core/dev.c:6181)
>    process_backlog (net/core/dev.c:6642)
>    __napi_poll (net/core/dev.c:7710)
>    net_rx_action (net/core/dev.c:7945)
>    handle_softirqs (kernel/softirq.c:622)
> 
> Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
> Reported-by: Weiming Shi <bestswngs@gmail.com>
> Suggested-by: Florian Westphal <fw@strlen.de>
> Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Xiang Mei <xmei5@asu.edu>
> ---

This looks good to me.

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

> v2: Fix the bug in configure path and correct the fix tag
> 
>   net/netfilter/nfnetlink_osf.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
> index 45d9ad231..70172ca07 100644
> --- a/net/netfilter/nfnetlink_osf.c
> +++ b/net/netfilter/nfnetlink_osf.c
> @@ -320,6 +320,10 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,
>   	if (f->opt_num > ARRAY_SIZE(f->opt))
>   		return -EINVAL;
>   
> +	if (f->wss.wc >= OSF_WSS_MAX ||
> +	    (f->wss.wc == OSF_WSS_MODULO && f->wss.val == 0))
> +		return -EINVAL;
> +
>   	for (i = 0; i < f->opt_num; i++) {
>   		if (!f->opt[i].length || f->opt[i].length > MAX_IPOPTLEN)
>   			return -EINVAL;