Taehee Yoo
705fd60523
netfilter: nf_tables: fix out-of-bounds in nft_chain_commit_update ...
[ Upstream commit d71efb599ad42ef1e564c652d8084252bdc85edf ]
When chain name is changed, nft_chain_commit_update is called.
In the nft_chain_commit_update, trans->ctx.chain->name has old chain name
and nft_trans_chain_name(trans) has new chain name.
If new chain name is longer than old chain name, KASAN warns
slab-out-of-bounds.
[ 175.015012] BUG: KASAN: slab-out-of-bounds in strcpy+0x9e/0xb0
[ 175.022735] Write of size 1 at addr ffff880114e022da by task iptables-compat/1458
[ 175.031353] CPU: 0 PID: 1458 Comm: iptables-compat Not tainted 4.16.0-rc7+ #146
[ 175.031353] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015
[ 175.031353] Call Trace:
[ 175.031353] dump_stack+0x68/0xa0
[ 175.031353] print_address_description+0xd0/0x260
[ 175.031353] ? strcpy+0x9e/0xb0
[ 175.031353] kasan_report+0x234/0x350
[ 175.031353] __asan_report_store1_noabort+0x1c/0x20
[ 175.031353] strcpy+0x9e/0xb0
[ 175.031353] nf_tables_commit+0x1ccc/0x2990
[ 175.031353] nfnetlink_rcv+0x141e/0x16c0
[ 175.031353] ? nfnetlink_net_init+0x150/0x150
[ 175.031353] ? lock_acquire+0x370/0x370
[ 175.031353] ? lock_acquire+0x370/0x370
[ 175.031353] netlink_unicast+0x444/0x640
[ 175.031353] ? netlink_attachskb+0x700/0x700
[ 175.031353] ? _copy_from_iter_full+0x180/0x740
[ 175.031353] ? kasan_check_write+0x14/0x20
[ 175.031353] ? _copy_from_user+0x9b/0xd0
[ 175.031353] netlink_sendmsg+0x845/0xc70
[ ... ]
Steps to reproduce:
iptables-compat -N 1
iptables-compat -E 1 aaaaaaaaa
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-21 04:02:44 +09:00
2017-11-02 11:10:55 +01:00
2018-02-22 15:42:30 +01:00
2017-11-02 11:10:55 +01:00
2018-05-30 07:52:16 +02:00
2017-11-02 11:10:55 +01:00
2018-05-16 10:10:29 +02:00
2017-11-02 11:10:55 +01:00
2018-05-30 07:52:19 +02:00
2018-04-19 08:56:19 +02:00
2017-05-02 11:46:28 -04:00
2018-05-30 07:52:14 +02:00
2017-11-02 11:10:55 +01:00
2018-01-23 19:58:17 +01:00
2018-05-30 07:52:04 +02:00
2018-06-11 22:49:22 +02:00
2017-08-09 16:57:38 -07:00
2018-06-11 22:49:18 +02:00
2018-02-25 11:07:52 +01:00
2018-04-29 11:33:10 +02:00
2018-04-24 09:36:39 +02:00
2017-06-16 11:48:40 -04:00
2017-08-22 13:40:23 -07:00
2018-03-31 18:10:40 +02:00
2018-04-29 11:33:13 +02:00
2018-06-11 22:49:19 +02:00
2018-06-21 04:02:43 +09:00
2017-11-02 11:10:55 +01:00
2018-03-31 18:10:41 +02:00
2018-06-11 22:49:19 +02:00
2018-06-16 09:45:14 +02:00
2018-05-19 10:20:27 +02:00
2017-07-04 22:35:16 +01:00
2018-05-30 07:52:20 +02:00
2018-05-30 07:52:02 +02:00
2017-11-02 11:10:55 +01:00
2018-02-22 15:42:28 +01:00
2017-10-21 01:56:38 +01:00
2018-06-21 04:02:44 +09:00
2018-05-30 07:52:40 +02:00
2018-05-16 10:10:23 +02:00
2017-07-04 22:35:17 +01:00
2018-05-30 07:51:57 +02:00
2018-05-19 10:20:26 +02:00
2018-05-19 10:20:24 +02:00
2018-06-11 22:49:20 +02:00
2017-11-02 11:10:55 +01:00
2017-11-01 12:19:03 +09:00
2018-05-30 07:52:05 +02:00
2018-05-30 07:52:10 +02:00
2018-05-16 10:10:26 +02:00
2018-05-30 07:52:26 +02:00
2018-06-11 22:49:22 +02:00
2018-06-11 22:49:20 +02:00
2018-05-30 07:52:32 +02:00
2018-04-29 11:33:13 +02:00
2018-04-26 11:02:19 +02:00
2017-08-07 14:48:48 -07:00
2018-06-21 04:02:43 +09:00
2018-05-30 07:51:56 +02:00
2017-11-02 10:04:46 -07:00
2018-02-25 11:07:59 +01:00
2017-11-02 11:10:55 +01:00
2018-05-30 07:51:58 +02:00
2017-11-02 11:10:55 +01:00
2018-05-30 07:52:19 +02:00
2018-05-19 10:20:24 +02:00
2017-09-04 13:25:20 +02:00
2017-11-02 11:10:55 +01:00
2018-02-22 15:42:23 +01:00
2017-04-16 23:42:49 -05:00
705fd60523