[PATCH nf] netfilter: nft_set_rbtree: narrow down range completion to anonymous sets

[PATCH nf] netfilter: nft_set_rbtree: narrow down range completion to anonymous sets

[Pablo Neira Ayuso]

For anonymous sets, when adjacent ranges are found, the end element is
not added to the set to pack the set representation. Use next start
element to complete this interval.

Jérémy Jean says:

Consider two ranges in a netfilter verdict map:
* keys 10-19 accept packets, and
* keys 30-39 jump to chain 'victim'.
Now, delete the end marker at 20. The lookup array now uses element 30
as the first range's end, so an INTERVAL_END query for key 15 returns
element 30, including its jump verdict and chain pointer. This can make
KASAN reports a UAF after the GC releases reference chain for 30 that
has expired:

  BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110
  Read of size 8 at addr ff110000009dfb58 by task repro/50
  ...
  Call Trace:
  ...
   nft_verdict_dump+0xdd/0x110
   nft_data_dump+0x4d/0x80
   nf_tables_fill_setelem+0x30b/0x8a0
   ? __asan_memcpy+0x3c/0x60
   nf_tables_fill_setelem_info+0x1b0/0x200
   nft_get_set_elem+0x3fd/0x4b0
  ...
  Freed by task 24:
  ...
   kfree+0x1a5/0x280
   nf_tables_trans_destroy_work+0x2cb/0x520

Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command")
Reported-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/netfilter-devel/20261005200404.3544062-2-Jeremy.Jean@oss.cyber.gouv.fr/
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_set_rbtree.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 12431b55752f..fbe1750f1ca2 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -1091,7 +1091,8 @@ static void nft_rbtree_commit(struct nft_set *set)
 		 * representation. Use next start element to complete this
 		 * interval.
 		 */
-		if (nft_rbtree_interval_start(rbe) &&
+		if (nft_set_is_anonymous(set) &&
+		    nft_rbtree_interval_start(rbe) &&
 		    nft_rbtree_interval_start(prev_rbe) &&
 		    priv->array_next->intervals[num_intervals].from)
 			priv->array_next->intervals[num_intervals++].to = &prev_rbe->ext;
-- 
2.47.3

Re: [PATCH nf] netfilter: nft_set_rbtree: narrow down range completion to anonymous sets

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> For anonymous sets, when adjacent ranges are found, the end element is
> not added to the set to pack the set representation. Use next start
> element to complete this interval.
> 
> Jérémy Jean says:
> 
> Consider two ranges in a netfilter verdict map:
> * keys 10-19 accept packets, and
> * keys 30-39 jump to chain 'victim'.
> Now, delete the end marker at 20. The lookup array now uses element 30
> as the first range's end, so an INTERVAL_END query for key 15 returns
> element 30, including its jump verdict and chain pointer. This can make
> KASAN reports a UAF after the GC releases reference chain for 30 that
> has expired:

Dumb question: How is it possible to remove an element if the map is
anonymous?

Re: [PATCH nf] netfilter: nft_set_rbtree: narrow down range completion to anonymous sets

[Pablo Neira Ayuso]

On Thu, Oct 08, 2026 at 08:32:54AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > For anonymous sets, when adjacent ranges are found, the end element is
> > not added to the set to pack the set representation. Use next start
> > element to complete this interval.
> > 
> > Jérémy Jean says:
> > 
> > Consider two ranges in a netfilter verdict map:
> > * keys 10-19 accept packets, and
> > * keys 30-39 jump to chain 'victim'.
> > Now, delete the end marker at 20. The lookup array now uses element 30
> > as the first range's end, so an INTERVAL_END query for key 15 returns
> > element 30, including its jump verdict and chain pointer. This can make
> > KASAN reports a UAF after the GC releases reference chain for 30 that
> > has expired:
> 
> Dumb question: How is it possible to remove an element if the map is
> anonymous?

I suspect this is a strange combination which cannot be reached from
userspace.

Re: [PATCH nf] netfilter: nft_set_rbtree: narrow down range completion to anonymous sets

[Pablo Neira Ayuso]

On Thu, Oct 08, 2026 at 12:52:35PM +0200, Pablo Neira Ayuso wrote:
> On Thu, Oct 08, 2026 at 08:32:54AM +0200, Florian Westphal wrote:
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > For anonymous sets, when adjacent ranges are found, the end element is
> > > not added to the set to pack the set representation. Use next start
> > > element to complete this interval.
> > > 
> > > Jérémy Jean says:
> > > 
> > > Consider two ranges in a netfilter verdict map:
> > > * keys 10-19 accept packets, and
> > > * keys 30-39 jump to chain 'victim'.
> > > Now, delete the end marker at 20. The lookup array now uses element 30
> > > as the first range's end, so an INTERVAL_END query for key 15 returns
> > > element 30, including its jump verdict and chain pointer. This can make
> > > KASAN reports a UAF after the GC releases reference chain for 30 that
> > > has expired:
> > 
> > Dumb question: How is it possible to remove an element if the map is
> > anonymous?
> 
> I suspect this is a strange combination which cannot be reached from
> userspace.

I mean, via nft.