From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 495B7C10F14 for ; Fri, 12 Apr 2019 17:55:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 12D232086D for ; Fri, 12 Apr 2019 17:55:12 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="cWY3R56r" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726797AbfDLRzL (ORCPT ); Fri, 12 Apr 2019 13:55:11 -0400 Received: from mail-pf1-f194.google.com ([209.85.210.194]:39880 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726765AbfDLRzL (ORCPT ); Fri, 12 Apr 2019 13:55:11 -0400 Received: by mail-pf1-f194.google.com with SMTP id i17so5494812pfo.6 for ; Fri, 12 Apr 2019 10:55:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=umXQHU83Pup7ysOpOPBdDBlgCVPRDx3Jd2+/N9CaNA4=; b=cWY3R56rEUsTHDiBF1mBiwJDWmLLb8rJzlKbM63osadHRG0x/p5zC/rfEya2tqhTq8 Xa2eQpEuDDRTGPEi2o9uPN7I6ThUM1dZeVaw3DFHt3HO/9rdlmeOAh2357OLJaObTCwr hs6//NHh8Z8XWKh4UVcM2e4Hc9coRXqQN/Q+c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=umXQHU83Pup7ysOpOPBdDBlgCVPRDx3Jd2+/N9CaNA4=; b=HQKFw6maD4YJlEmLCzjSUpWajlk1oXnCXQffFMFUY6aCkw9PGQhM07nnvtv5NuslKk GMAC53Fi2ROjH6sV3GcXk/g/P1ExgGU5j6vlEmgeiQo5bS91fEAeFbBTW/SkFJ6tA0VJ 3ah/3QBuSgkzhg9G5JCZu1aQCi5D/BuXpHv4+7L8afx2AM9qUu6DrYc/g/CeI9SZix6k xi39v/UxezQdq6j3mfPYV2OAUxW97DbAbdcegzMcsRsgIhrLJUno+9KLK5fqqtS/A0LX rw5+U57VSA5AkpJpdAtM+8ZbU/z04QVdpmp0QStXAuK26VB24BHMvBCkpphgRUhsStOd gQCA== X-Gm-Message-State: APjAAAVOfAJ+p/stE3qL3/BAXsNQZ3It4O4EhKZ7IVvdq6jIHJIg75eX UWjcReu7A9H8CNF2z9z4uToHDNwvBEJUfQ== X-Google-Smtp-Source: APXvYqx50joqbLK5/23dP2e3IsZ2FRl9a/s44dw6tQh9QJyTzhWKMSLJF5YDskpKFtqPRIRSLXTE4w== X-Received: by 2002:a62:8381:: with SMTP id h123mr58766202pfe.226.1555091709896; Fri, 12 Apr 2019 10:55:09 -0700 (PDT) Received: from zsm-linux.mtv.corp.google.com ([2620:15c:202:201:49ea:b78f:4f04:4d25]) by smtp.googlemail.com with ESMTPSA id a24sm46133190pgv.10.2019.04.12.10.55.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 12 Apr 2019 10:55:08 -0700 (PDT) From: Zubin Mithra To: stable@vger.kernel.org Cc: gregkh@linuxfoundation.org, groeck@chromium.org, pablo@netfilter.org, fw@strlen.de, eric.dumazet@gmail.com, kadlec@blackhole.kfki.hu, davem@davemloft.net Subject: [PATCH v4.19.y 1/2] netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr Date: Fri, 12 Apr 2019 10:55:02 -0700 Message-Id: <20190412175503.132995-1-zsm@chromium.org> X-Mailer: git-send-email 2.21.0.392.gf8f6787159e-goog MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pablo Neira Ayuso commit 8866df9264a34e675b4ee8a151db819b87cce2d3 upstream Otherwise, we hit a NULL pointer deference since handlers always assume default timeout policy is passed. netlink: 24 bytes leftover after parsing attributes in process `syz-executor2'. kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9575 Comm: syz-executor1 Not tainted 4.19.0+ #312 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:icmp_timeout_obj_to_nlattr+0x77/0x170 net/netfilter/nf_conntrack_proto_icmp.c:297 Fixes: c779e849608a ("netfilter: conntrack: remove get_timeout() indirection") Reported-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso Signed-off-by: Zubin Mithra --- Notes: * Syzkaller reported a general protection fault in icmp_timeout_obj_to_nlattri when fuzzing a 4.19 kernel. Call Trace: cttimeout_default_fill_info net/netfilter/nfnetlink_cttimeout.c:424 [inline] cttimeout_default_get+0x574/0x766 net/netfilter/nfnetlink_cttimeout.c:471 nfnetlink_rcv_msg+0x544/0x5bd net/netfilter/nfnetlink.c:228 netlink_rcv_skb+0x1cf/0x2a1 net/netlink/af_netlink.c:2454 nfnetlink_rcv+0x30f/0x34a net/netfilter/nfnetlink.c:560 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x3c5/0x4c3 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x829/0x88e net/netlink/af_netlink.c:1908 sock_sendmsg_nosec+0x8c/0xad net/socket.c:621 sock_sendmsg+0x4f/0x60 net/socket.c:631 ___sys_sendmsg+0x4d6/0x63f net/socket.c:2116 __sys_sendmsg+0xee/0x17b net/socket.c:2154 do_syscall_64+0xf8/0x133 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x49/0xbe * This patch resolves the following conflicts when applying to 4.19: - l3num is not used as an argument for cttimeout_default_fill_info() in 4.19 - nf_icmp_pernet, nf_tcp_pernet, nf_udp_pernet, nf_dccp_pernet, nf_icmpv6_pernet, nf_sctp_pernet, nf_generic_pernet do not exist in 4.19. Expand the usage of those functions into one-liners. * Tests run: Chrome OS tryjobs, Syzkaller reproducer net/netfilter/nfnetlink_cttimeout.c | 46 +++++++++++++++++++++++++---- 1 file changed, 40 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c index a30f8ba4b89a..1dc4ea327cbe 100644 --- a/net/netfilter/nfnetlink_cttimeout.c +++ b/net/netfilter/nfnetlink_cttimeout.c @@ -392,7 +392,8 @@ static int cttimeout_default_set(struct net *net, struct sock *ctnl, static int cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid, u32 seq, u32 type, int event, - const struct nf_conntrack_l4proto *l4proto) + const struct nf_conntrack_l4proto *l4proto, + const unsigned int *timeouts) { struct nlmsghdr *nlh; struct nfgenmsg *nfmsg; @@ -421,7 +422,7 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid, if (!nest_parms) goto nla_put_failure; - ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, NULL); + ret = l4proto->ctnl_timeout.obj_to_nlattr(skb, timeouts); if (ret < 0) goto nla_put_failure; @@ -444,6 +445,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, struct netlink_ext_ack *extack) { const struct nf_conntrack_l4proto *l4proto; + unsigned int *timeouts = NULL; struct sk_buff *skb2; int ret, err; __u16 l3num; @@ -456,12 +458,44 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, l4num = nla_get_u8(cda[CTA_TIMEOUT_L4PROTO]); l4proto = nf_ct_l4proto_find_get(l3num, l4num); - /* This protocol is not supported, skip. */ - if (l4proto->l4proto != l4num) { - err = -EOPNOTSUPP; + err = -EOPNOTSUPP; + if (l4proto->l4proto != l4num) goto err; + + switch (l4proto->l4proto) { + case IPPROTO_ICMP: + timeouts = &net->ct.nf_ct_proto.icmp.timeout; + break; + case IPPROTO_TCP: + timeouts = net->ct.nf_ct_proto.tcp.timeouts; + break; + case IPPROTO_UDP: + timeouts = net->ct.nf_ct_proto.udp.timeouts; + break; + case IPPROTO_DCCP: +#ifdef CONFIG_NF_CT_PROTO_DCCP + timeouts = net->ct.nf_ct_proto.dccp.dccp_timeout; +#endif + break; + case IPPROTO_ICMPV6: + timeouts = &net->ct.nf_ct_proto.icmpv6.timeout; + break; + case IPPROTO_SCTP: +#ifdef CONFIG_NF_CT_PROTO_SCTP + timeouts = net->ct.nf_ct_proto.sctp.timeouts; +#endif + break; + case 255: + timeouts = &net->ct.nf_ct_proto.generic.timeout; + break; + default: + WARN_ON_ONCE(1); + break; } + if (!timeouts) + goto err; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); if (skb2 == NULL) { err = -ENOMEM; @@ -472,7 +506,7 @@ static int cttimeout_default_get(struct net *net, struct sock *ctnl, nlh->nlmsg_seq, NFNL_MSG_TYPE(nlh->nlmsg_type), IPCTNL_MSG_TIMEOUT_DEFAULT_SET, - l4proto); + l4proto, timeouts); if (ret <= 0) { kfree_skb(skb2); err = -ENOMEM; -- 2.21.0.392.gf8f6787159e-goog