[PATCH nf 1/2] netfilter: nf_tables: registers should not go over NFT_REG32_NUM

[PATCH nf 1/2] netfilter: nf_tables: registers should not go over NFT_REG32_NUM

[Pablo Neira Ayuso]

Bail out in case userspace uses registers over maximum number of register.

Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d71a33ae39b3..829ecd310ae6 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9275,17 +9275,24 @@ int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
 }
 EXPORT_SYMBOL_GPL(nft_parse_u32_check);
 
-static unsigned int nft_parse_register(const struct nlattr *attr)
+static unsigned int nft_parse_register(const struct nlattr *attr, u32 *preg)
 {
 	unsigned int reg;
 
 	reg = ntohl(nla_get_be32(attr));
+	if (reg >= NFT_REG32_NUM)
+		return -ERANGE;
+
 	switch (reg) {
 	case NFT_REG_VERDICT...NFT_REG_4:
-		return reg * NFT_REG_SIZE / NFT_REG32_SIZE;
+		*preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE;
+		break;
 	default:
-		return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
+		*preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;
+		break;
 	}
+
+	return 0;
 }
 
 /**
@@ -9327,7 +9334,10 @@ int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len)
 	u32 reg;
 	int err;
 
-	reg = nft_parse_register(attr);
+	err = nft_parse_register(attr, &reg);
+	if (err < 0)
+		return err;
+
 	err = nft_validate_register_load(reg, len);
 	if (err < 0)
 		return err;
@@ -9382,7 +9392,10 @@ int nft_parse_register_store(const struct nft_ctx *ctx,
 	int err;
 	u32 reg;
 
-	reg = nft_parse_register(attr);
+	err = nft_parse_register(attr, &reg);
+	if (err < 0)
+		return err;
+
 	err = nft_validate_register_store(ctx, reg, data, type, len);
 	if (err < 0)
 		return err;
-- 
2.30.2

[PATCH nf 2/2] netfilter: nf_tables: initialize registers in nft_do_chain()

[Pablo Neira Ayuso]

Initialize registers to avoid stack leak into userspace.

Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 36e73f9828c5..8af98239655d 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -201,7 +201,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv)
 	const struct nft_rule_dp *rule, *last_rule;
 	const struct net *net = nft_net(pkt);
 	const struct nft_expr *expr, *last;
-	struct nft_regs regs;
+	struct nft_regs regs = {};
 	unsigned int stackptr = 0;
 	struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
 	bool genbit = READ_ONCE(net->nft.gencursor);
-- 
2.30.2

Re: [PATCH nf 1/2] netfilter: nf_tables: registers should not go over NFT_REG32_NUM

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Bail out in case userspace uses registers over maximum number of register.
> 
> Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  net/netfilter/nf_tables_api.c | 23 ++++++++++++++++++-----
>  1 file changed, 18 insertions(+), 5 deletions(-)
> 
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index d71a33ae39b3..829ecd310ae6 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -9275,17 +9275,24 @@ int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
>  }
>  EXPORT_SYMBOL_GPL(nft_parse_u32_check);
>  
> -static unsigned int nft_parse_register(const struct nlattr *attr)
> +static unsigned int nft_parse_register(const struct nlattr *attr, u32 *preg)
>  {
>  	unsigned int reg;
>  
>  	reg = ntohl(nla_get_be32(attr));
> +	if (reg >= NFT_REG32_NUM)
> +		return -ERANGE;
> +

This breaks userspace.

NFT_REG32_00 is 8, so this makes NFT_REG32_13, 14 and 15 invalid.

Re: [PATCH nf 1/2] netfilter: nf_tables: registers should not go over NFT_REG32_NUM

[Pablo Neira Ayuso]

On Thu, Mar 17, 2022 at 01:53:13PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Bail out in case userspace uses registers over maximum number of register.
> > 
> > Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing")
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> >  net/netfilter/nf_tables_api.c | 23 ++++++++++++++++++-----
> >  1 file changed, 18 insertions(+), 5 deletions(-)
> > 
> > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> > index d71a33ae39b3..829ecd310ae6 100644
> > --- a/net/netfilter/nf_tables_api.c
> > +++ b/net/netfilter/nf_tables_api.c
> > @@ -9275,17 +9275,24 @@ int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest)
> >  }
> >  EXPORT_SYMBOL_GPL(nft_parse_u32_check);
> >  
> > -static unsigned int nft_parse_register(const struct nlattr *attr)
> > +static unsigned int nft_parse_register(const struct nlattr *attr, u32 *preg)
> >  {
> >  	unsigned int reg;
> >  
> >  	reg = ntohl(nla_get_be32(attr));
> > +	if (reg >= NFT_REG32_NUM)
> > +		return -ERANGE;
> > +
> 
> This breaks userspace.
> 
> NFT_REG32_00 is 8, so this makes NFT_REG32_13, 14 and 15 invalid.

Sending v2. Thanks for reviewing