* [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
@ 2026-04-10 20:48 Xiang Mei
2026-04-11 7:56 ` Fernando Fernandez Mancera
2026-04-11 20:41 ` Florian Westphal
0 siblings, 2 replies; 6+ messages in thread
From: Xiang Mei @ 2026-04-10 20:48 UTC (permalink / raw)
To: netfilter-devel
Cc: Pablo Neira Ayuso, Florian Westphal, Phil Sutter, coreteam,
Weiming Shi, Xiang Mei
The OSF_WSS_MODULO branch in nf_osf_match_one() performs:
ctx->window % f->wss.val
without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN
can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0
via nfnetlink. When a matching TCP SYN packet arrives, the kernel
executes a division by zero and panics.
The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match
everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,
any window value matches rather than dividing by zero.
Crash:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
Call Trace:
<IRQ>
nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))
xt_osf_match_packet (net/netfilter/xt_osf.c:32)
ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))
ip_local_deliver (net/ipv4/ip_input.c:265)
ip_rcv (include/linux/skbuff.h:1162)
__netif_receive_skb_one_core (net/core/dev.c:6181)
process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)
__napi_poll (net/core/dev.c:7710)
net_rx_action (net/core/dev.c:7945)
handle_softirqs (kernel/softirq.c:622)
Fixes: 31a9c29210e2 ("netfilter: nf_osf: add struct nf_osf_hdr_ctx")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
net/netfilter/nfnetlink_osf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 45d9ad231..193436aa9 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -150,7 +150,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
fmatch = FMATCH_OK;
break;
case OSF_WSS_MODULO:
- if ((ctx->window % f->wss.val) == 0)
+ if (f->wss.val == 0 || (ctx->window % f->wss.val) == 0)
fmatch = FMATCH_OK;
break;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
2026-04-10 20:48 [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Xiang Mei
@ 2026-04-11 7:56 ` Fernando Fernandez Mancera
2026-04-11 20:41 ` Florian Westphal
1 sibling, 0 replies; 6+ messages in thread
From: Fernando Fernandez Mancera @ 2026-04-11 7:56 UTC (permalink / raw)
To: Xiang Mei, netfilter-devel
Cc: Pablo Neira Ayuso, Florian Westphal, Phil Sutter, coreteam,
Weiming Shi
On 4/10/26 10:48 PM, Xiang Mei wrote:
> The OSF_WSS_MODULO branch in nf_osf_match_one() performs:
>
> ctx->window % f->wss.val
>
> without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN
> can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0
> via nfnetlink. When a matching TCP SYN packet arrives, the kernel
> executes a division by zero and panics.
>
> The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match
> everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,
> any window value matches rather than dividing by zero.
>
> Crash:
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
> Call Trace:
> <IRQ>
> nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))
> xt_osf_match_packet (net/netfilter/xt_osf.c:32)
> ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
> nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))
> ip_local_deliver (net/ipv4/ip_input.c:265)
> ip_rcv (include/linux/skbuff.h:1162)
> __netif_receive_skb_one_core (net/core/dev.c:6181)
> process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)
> __napi_poll (net/core/dev.c:7710)
> net_rx_action (net/core/dev.c:7945)
> handle_softirqs (kernel/softirq.c:622)
>
> Fixes: 31a9c29210e2 ("netfilter: nf_osf: add struct nf_osf_hdr_ctx")
> Reported-by: Weiming Shi <bestswngs@gmail.com>
> Signed-off-by: Xiang Mei <xmei5@asu.edu>
LGTM, but I don't see this happening at all to be honest. Such
fingerprint would be bogus anyway.
The fixes tag is not correct I think. This was introduced on
11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") actually.
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
2026-04-10 20:48 [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Xiang Mei
2026-04-11 7:56 ` Fernando Fernandez Mancera
@ 2026-04-11 20:41 ` Florian Westphal
2026-04-14 11:01 ` Pablo Neira Ayuso
1 sibling, 1 reply; 6+ messages in thread
From: Florian Westphal @ 2026-04-11 20:41 UTC (permalink / raw)
To: Xiang Mei
Cc: netfilter-devel, Pablo Neira Ayuso, Phil Sutter, coreteam,
Weiming Shi
Xiang Mei <xmei5@asu.edu> wrote:
> The OSF_WSS_MODULO branch in nf_osf_match_one() performs:
>
> ctx->window % f->wss.val
>
> without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN
> can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0
> via nfnetlink. When a matching TCP SYN packet arrives, the kernel
> executes a division by zero and panics.
>
> The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match
> everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,
> any window value matches rather than dividing by zero.
>
> Crash:
> Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
> Call Trace:
> <IRQ>
> nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))
> xt_osf_match_packet (net/netfilter/xt_osf.c:32)
> ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
> nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))
> ip_local_deliver (net/ipv4/ip_input.c:265)
> ip_rcv (include/linux/skbuff.h:1162)
> __netif_receive_skb_one_core (net/core/dev.c:6181)
> process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)
> __napi_poll (net/core/dev.c:7710)
> net_rx_action (net/core/dev.c:7945)
> handle_softirqs (kernel/softirq.c:622)
>
> Fixes: 31a9c29210e2 ("netfilter: nf_osf: add struct nf_osf_hdr_ctx")
Hmm, why? AFAICS the bug was there from start:
11eeef41d5f63 case OSF_WSS_MODULO:
11eeef41d5f63 if ((window % f->wss.val) == 0)
11eeef41d5f63 fmatch = FMATCH_OK;
So:
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
> diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
> index 45d9ad231..193436aa9 100644
> --- a/net/netfilter/nfnetlink_osf.c
> +++ b/net/netfilter/nfnetlink_osf.c
> @@ -150,7 +150,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
> fmatch = FMATCH_OK;
> break;
> case OSF_WSS_MODULO:
> - if ((ctx->window % f->wss.val) == 0)
> + if (f->wss.val == 0 || (ctx->window % f->wss.val) == 0)
Could you send a v2 that rejects this from control plane instead?
Nobody is using a 0 value, else we'd have gotted such crash reports by
now.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
2026-04-11 20:41 ` Florian Westphal
@ 2026-04-14 11:01 ` Pablo Neira Ayuso
2026-04-14 11:11 ` Florian Westphal
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2026-04-14 11:01 UTC (permalink / raw)
To: Florian Westphal
Cc: Xiang Mei, netfilter-devel, Phil Sutter, coreteam, Weiming Shi
On Sat, Apr 11, 2026 at 10:41:32PM +0200, Florian Westphal wrote:
> Xiang Mei <xmei5@asu.edu> wrote:
> > The OSF_WSS_MODULO branch in nf_osf_match_one() performs:
> >
> > ctx->window % f->wss.val
> >
> > without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN
> > can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0
> > via nfnetlink. When a matching TCP SYN packet arrives, the kernel
> > executes a division by zero and panics.
> >
> > The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match
> > everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,
> > any window value matches rather than dividing by zero.
> >
> > Crash:
> > Oops: divide error: 0000 [#1] SMP KASAN NOPTI
> > RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
> > Call Trace:
> > <IRQ>
> > nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))
> > xt_osf_match_packet (net/netfilter/xt_osf.c:32)
> > ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
> > nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))
> > ip_local_deliver (net/ipv4/ip_input.c:265)
> > ip_rcv (include/linux/skbuff.h:1162)
> > __netif_receive_skb_one_core (net/core/dev.c:6181)
> > process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)
> > __napi_poll (net/core/dev.c:7710)
> > net_rx_action (net/core/dev.c:7945)
> > handle_softirqs (kernel/softirq.c:622)
> >
> > Fixes: 31a9c29210e2 ("netfilter: nf_osf: add struct nf_osf_hdr_ctx")
>
> Hmm, why? AFAICS the bug was there from start:
>
> 11eeef41d5f63 case OSF_WSS_MODULO:
> 11eeef41d5f63 if ((window % f->wss.val) == 0)
> 11eeef41d5f63 fmatch = FMATCH_OK;
>
> So:
> Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
>
> > diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
> > index 45d9ad231..193436aa9 100644
> > --- a/net/netfilter/nfnetlink_osf.c
> > +++ b/net/netfilter/nfnetlink_osf.c
> > @@ -150,7 +150,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
> > fmatch = FMATCH_OK;
> > break;
> > case OSF_WSS_MODULO:
> > - if ((ctx->window % f->wss.val) == 0)
> > + if (f->wss.val == 0 || (ctx->window % f->wss.val) == 0)
>
> Could you send a v2 that rejects this from control plane instead?
> Nobody is using a 0 value, else we'd have gotted such crash reports by
> now.
No news from this, I think this should be fine:
@@ -329,6 +332,15 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,
if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)
return -EINVAL;
+ switch (f->wss.wc) {
+ case OSF_WSS_MODULO:
+ if (f->wss.val == 0)
+ return -EINVAL;
+ break;
+ default:
+ break;
+ }
+
tot_opt_len += f->opt[i].length;
if (tot_opt_len > MAX_IPOPTLEN)
return -EINVAL;
If no concerns, I will post a patch.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
2026-04-14 11:01 ` Pablo Neira Ayuso
@ 2026-04-14 11:11 ` Florian Westphal
0 siblings, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2026-04-14 11:11 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Xiang Mei, netfilter-devel, Phil Sutter, coreteam, Weiming Shi
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> @@ -329,6 +332,15 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,
> if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)
> return -EINVAL;
>
> + switch (f->wss.wc) {
> + case OSF_WSS_MODULO:
> + if (f->wss.val == 0)
> + return -EINVAL;
> + break;
> + default:
> + break;
> + }
> +
> tot_opt_len += f->opt[i].length;
> if (tot_opt_len > MAX_IPOPTLEN)
> return -EINVAL;
>
> If no concerns, I will post a patch.
Thanks Pablo, LGTM.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
@ 2026-04-14 11:17 Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2026-04-14 11:17 UTC (permalink / raw)
To: netfilter-devel; +Cc: xmei5, fw
Xiang Mei says:
The OSF_WSS_MODULO branch in nf_osf_match_one() performs:
ctx->window % f->wss.val
without guarding against f->wss.val == 0. A user with CAP_NET_ADMIN
can add an OSF fingerprint with wss.wc = OSF_WSS_MODULO and wss.val = 0
via nfnetlink. When a matching TCP SYN packet arrives, the kernel
executes a division by zero and panics.
The OSF_WSS_PLAIN case already treats val == 0 as a wildcard (match
everything). Apply the same semantics to OSF_WSS_MODULO: if val is 0,
any window value matches rather than dividing by zero.
Crash:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
Call Trace:
<IRQ>
nf_osf_match (net/netfilter/nfnetlink_osf.c:220 (discriminator 6))
xt_osf_match_packet (net/netfilter/xt_osf.c:32)
ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
nf_hook_slow (net/netfilter/core.c:622 (discriminator 1))
ip_local_deliver (net/ipv4/ip_input.c:265)
ip_rcv (include/linux/skbuff.h:1162)
__netif_receive_skb_one_core (net/core/dev.c:6181)
process_backlog (.include/linux/skbuff.h:2502 net/core/dev.c:6642)
__napi_poll (net/core/dev.c:7710)
net_rx_action (net/core/dev.c:7945)
handle_softirqs (kernel/softirq.c:622
Fix this from control plane, reject f->wss.val == 0 if wss.ws is
OSF_WSS_MODULO.
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Apologies, I don't mean to step on your feet with this patch.
This just expedites scrutiny before PR submission.
net/netfilter/nfnetlink_osf.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 5d15651c74f0..bf47a3812910 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -329,6 +329,15 @@ static int nfnl_osf_add_callback(struct sk_buff *skb,
if (f->opt[i].kind == OSFOPT_MSS && f->opt[i].length < 4)
return -EINVAL;
+ switch (f->wss.wc) {
+ case OSF_WSS_MODULO:
+ if (f->wss.val == 0)
+ return -EINVAL;
+ break;
+ default:
+ break;
+ }
+
tot_opt_len += f->opt[i].length;
if (tot_opt_len > MAX_IPOPTLEN)
return -EINVAL;
--
2.47.3
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-04-14 11:17 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-10 20:48 [PATCH nf] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO Xiang Mei
2026-04-11 7:56 ` Fernando Fernandez Mancera
2026-04-11 20:41 ` Florian Westphal
2026-04-14 11:01 ` Pablo Neira Ayuso
2026-04-14 11:11 ` Florian Westphal
-- strict thread matches above, loose matches on Subject: below --
2026-04-14 11:17 Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox