Liping Zhang
1c759b361b
netfilter: nf_tables: fix oops when inserting an element into a verdict map ...
commit 58c78e104d937c1f560fb10ed9bb2dcde0db4fcf upstream.
Dalegaard says:
The following ruleset, when loaded with 'nft -f bad.txt'
----snip----
flush ruleset
table ip inlinenat {
map sourcemap {
type ipv4_addr : verdict;
}
chain postrouting {
ip saddr vmap @sourcemap accept
}
}
add chain inlinenat test
add element inlinenat sourcemap { 100.123.10.2 : jump test }
----snip----
results in a kernel oops:
BUG: unable to handle kernel paging request at 0000000000001344
IP: [<ffffffffa07bf704>] nf_tables_check_loops+0x114/0x1f0 [nf_tables]
[...]
Call Trace:
[<ffffffffa07c2aae>] ? nft_data_init+0x13e/0x1a0 [nf_tables]
[<ffffffffa07c1950>] nft_validate_register_store+0x60/0xb0 [nf_tables]
[<ffffffffa07c74b5>] nft_add_set_elem+0x545/0x5e0 [nf_tables]
[<ffffffffa07bfdd0>] ? nft_table_lookup+0x30/0x60 [nf_tables]
[<ffffffff8132c630>] ? nla_strcmp+0x40/0x50
[<ffffffffa07c766e>] nf_tables_newsetelem+0x11e/0x210 [nf_tables]
[<ffffffff8132c400>] ? nla_validate+0x60/0x80
[<ffffffffa030d9b4>] nfnetlink_rcv+0x354/0x5a7 [nfnetlink]
Because we forget to fill the net pointer in bind_ctx, so dereferencing
it may cause kernel crash.
Reported-by: Dalegaard <dalegaard@gmail.com>
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-01 09:46:40 +01:00
2018-10-10 08:52:04 +02:00
2018-11-21 09:27:39 +01:00
2018-04-13 19:50:25 +02:00
2018-05-16 10:06:51 +02:00
2017-02-04 09:45:09 +01:00
2018-05-30 07:49:06 +02:00
2018-11-10 07:41:33 -08:00
2018-11-10 07:41:41 -08:00
2018-09-05 09:18:34 +02:00
2018-01-31 12:06:08 +01:00
2018-05-02 07:53:42 -07:00
2018-11-27 16:07:57 +01:00
2018-09-19 22:48:58 +02:00
2018-08-22 07:48:35 +02:00
2018-02-25 11:03:38 +01:00
2018-07-22 14:25:54 +02:00
2018-08-06 16:24:41 +02:00
2017-02-18 16:39:27 +01:00
2015-11-23 14:56:15 -05:00
2018-09-09 20:04:32 +02:00
2018-11-27 16:07:57 +01:00
2018-11-27 16:07:57 +01:00
2017-05-25 14:30:13 +02:00
2018-09-15 09:40:40 +02:00
2018-11-10 07:41:35 -08:00
2018-06-16 09:54:25 +02:00
2018-11-10 07:41:43 -08:00
2015-10-07 04:27:43 -07:00
2018-12-01 09:46:34 +01:00
2018-11-10 07:41:33 -08:00
2018-09-09 20:04:32 +02:00
2018-03-11 16:19:47 +01:00
2018-12-01 09:46:40 +01:00
2018-10-20 09:52:36 +02:00
2018-08-09 12:19:28 +02:00
2018-09-29 03:08:51 -07:00
2018-05-26 08:48:47 +02:00
2018-08-24 13:27:01 +02:00
2016-01-31 11:29:00 -08:00
2018-07-22 14:25:54 +02:00
2018-05-16 10:06:51 +02:00
2018-04-13 19:50:23 +02:00
2018-11-10 07:41:41 -08:00
2018-12-01 09:46:33 +01:00
2018-12-01 09:46:34 +01:00
2016-06-24 10:18:16 -07:00
2018-04-29 07:50:06 +02:00
2018-11-10 07:41:34 -08:00
2018-08-22 07:48:35 +02:00
2015-08-09 22:43:52 -07:00
2018-11-10 07:41:33 -08:00
2018-04-13 19:50:07 +02:00
2018-11-10 07:41:37 -08:00
2018-05-26 08:48:47 +02:00
2018-02-25 11:03:37 +01:00
2015-09-29 20:40:32 -07:00
2018-11-10 07:41:41 -08:00
2016-09-15 08:27:50 +02:00
1c759b361b