Thadeu Lima de Souza Cascardo 40b46d8656 UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval ... commit caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd upstream. When evaluating byteorder expressions with size 2, a union with 32-bit and 16-bit members is used. Since the 16-bit members are aligned to 32-bit, the array accesses will be out-of-bounds. It may lead to a stack-out-of-bounds access like the one below: [ 23.095215] ================================================================== [ 23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320 [ 23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115 [ 23.096358] [ 23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413 [ 23.096770] Call Trace: [ 23.096910] <IRQ> [ 23.097030] dump_stack_lvl+0x60/0xc0 [ 23.097218] print_report+0xcf/0x630 [ 23.097388] ? nft_byteorder_eval+0x13c/0x320 [ 23.097577] ? kasan_addr_to_slab+0xd/0xc0 [ 23.097760] ? nft_byteorder_eval+0x13c/0x320 [ 23.097949] kasan_report+0xc9/0x110 [ 23.098106] ? nft_byteorder_eval+0x13c/0x320 [ 23.098298] __asan_load2+0x83/0xd0 [ 23.098453] nft_byteorder_eval+0x13c/0x320 [ 23.098659] nft_do_chain+0x1c8/0xc50 [ 23.098852] ? __pfx_nft_do_chain+0x10/0x10 [ 23.099078] ? __kasan_check_read+0x11/0x20 [ 23.099295] ? __pfx___lock_acquire+0x10/0x10 [ 23.099535] ? __pfx___lock_acquire+0x10/0x10 [ 23.099745] ? __kasan_check_read+0x11/0x20 [ 23.099929] nft_do_chain_ipv4+0xfe/0x140 [ 23.100105] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 23.100327] ? lock_release+0x204/0x400 [ 23.100515] ? nf_hook.constprop.0+0x340/0x550 [ 23.100779] nf_hook_slow+0x6c/0x100 [ 23.100977] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 23.101223] nf_hook.constprop.0+0x334/0x550 [ 23.101443] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 23.101677] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 23.101882] ? __pfx_ip_rcv_finish+0x10/0x10 [ 23.102071] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 23.102291] ? rcu_read_lock_held+0x4b/0x70 [ 23.102481] ip_local_deliver+0xbb/0x110 [ 23.102665] ? __pfx_ip_rcv+0x10/0x10 [ 23.102839] ip_rcv+0x199/0x2a0 [ 23.102980] ? __pfx_ip_rcv+0x10/0x10 [ 23.103140] __netif_receive_skb_one_core+0x13e/0x150 [ 23.103362] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 23.103647] ? mark_held_locks+0x48/0xa0 [ 23.103819] ? process_backlog+0x36c/0x380 [ 23.103999] __netif_receive_skb+0x23/0xc0 [ 23.104179] process_backlog+0x91/0x380 [ 23.104350] __napi_poll.constprop.0+0x66/0x360 [ 23.104589] ? net_rx_action+0x1cb/0x610 [ 23.104811] net_rx_action+0x33e/0x610 [ 23.105024] ? _raw_spin_unlock+0x23/0x50 [ 23.105257] ? __pfx_net_rx_action+0x10/0x10 [ 23.105485] ? mark_held_locks+0x48/0xa0 [ 23.105741] __do_softirq+0xfa/0x5ab [ 23.105956] ? __dev_queue_xmit+0x765/0x1c00 [ 23.106193] do_softirq.part.0+0x49/0xc0 [ 23.106423] </IRQ> [ 23.106547] <TASK> [ 23.106670] __local_bh_enable_ip+0xf5/0x120 [ 23.106903] __dev_queue_xmit+0x789/0x1c00 [ 23.107131] ? __pfx___dev_queue_xmit+0x10/0x10 [ 23.107381] ? find_held_lock+0x8e/0xb0 [ 23.107585] ? lock_release+0x204/0x400 [ 23.107798] ? neigh_resolve_output+0x185/0x350 [ 23.108049] ? mark_held_locks+0x48/0xa0 [ 23.108265] ? neigh_resolve_output+0x185/0x350 [ 23.108514] neigh_resolve_output+0x246/0x350 [ 23.108753] ? neigh_resolve_output+0x246/0x350 [ 23.109003] ip_finish_output2+0x3c3/0x10b0 [ 23.109250] ? __pfx_ip_finish_output2+0x10/0x10 [ 23.109510] ? __pfx_nf_hook+0x10/0x10 [ 23.109732] __ip_finish_output+0x217/0x390 [ 23.109978] ip_finish_output+0x2f/0x130 [ 23.110207] ip_output+0xc9/0x170 [ 23.110404] ip_push_pending_frames+0x1a0/0x240 [ 23.110652] raw_sendmsg+0x102e/0x19e0 [ 23.110871] ? __pfx_raw_sendmsg+0x10/0x10 [ 23.111093] ? lock_release+0x204/0x400 [ 23.111304] ? __mod_lruvec_page_state+0x148/0x330 [ 23.111567] ? find_held_lock+0x8e/0xb0 [ 23.111777] ? find_held_lock+0x8e/0xb0 [ 23.111993] ? __rcu_read_unlock+0x7c/0x2f0 [ 23.112225] ? aa_sk_perm+0x18a/0x550 [ 23.112431] ? filemap_map_pages+0x4f1/0x900 [ 23.112665] ? __pfx_aa_sk_perm+0x10/0x10 [ 23.112880] ? find_held_lock+0x8e/0xb0 [ 23.113098] inet_sendmsg+0xa0/0xb0 [ 23.113297] ? inet_sendmsg+0xa0/0xb0 [ 23.113500] ? __pfx_inet_sendmsg+0x10/0x10 [ 23.113727] sock_sendmsg+0xf4/0x100 [ 23.113924] ? move_addr_to_kernel.part.0+0x4f/0xa0 [ 23.114190] __sys_sendto+0x1d4/0x290 [ 23.114391] ? __pfx___sys_sendto+0x10/0x10 [ 23.114621] ? __pfx_mark_lock.part.0+0x10/0x10 [ 23.114869] ? lock_release+0x204/0x400 [ 23.115076] ? find_held_lock+0x8e/0xb0 [ 23.115287] ? rcu_is_watching+0x23/0x60 [ 23.115503] ? __rseq_handle_notify_resume+0x6e2/0x860 [ 23.115778] ? __kasan_check_write+0x14/0x30 [ 23.116008] ? blkcg_maybe_throttle_current+0x8d/0x770 [ 23.116285] ? mark_held_locks+0x28/0xa0 [ 23.116503] ? do_syscall_64+0x37/0x90 [ 23.116713] __x64_sys_sendto+0x7f/0xb0 [ 23.116924] do_syscall_64+0x59/0x90 [ 23.117123] ? irqentry_exit_to_user_mode+0x25/0x30 [ 23.117387] ? irqentry_exit+0x77/0xb0 [ 23.117593] ? exc_page_fault+0x92/0x140 [ 23.117806] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 23.118081] RIP: 0033:0x7f744aee2bba [ 23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba [ 23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003 [ 23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010 [ 23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0 [ 23.121617] </TASK> [ 23.121749] [ 23.121845] The buggy address belongs to the virtual mapping at [ 23.121845] [ffffc90000000000, ffffc90000009000) created by: [ 23.121845] irq_init_percpu_irqstack+0x1cf/0x270 [ 23.122707] [ 23.122803] The buggy address belongs to the physical page: [ 23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09 [ 23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff) [ 23.123998] page_type: 0xffffffff() [ 23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000 [ 23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 23.125023] page dumped because: kasan: bad access detected [ 23.125326] [ 23.125421] Memory state around the buggy address: [ 23.125682] ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.126072] ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00 [ 23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 [ 23.126840] ^ [ 23.127138] ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 [ 23.127522] ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 [ 23.127906] ================================================================== [ 23.128324] Disabling lock debugging due to kernel taint Using simple s16 pointers for the 16-bit accesses fixes the problem. For the 32-bit accesses, src and dst can be used directly. Bug: 291031528 Fixes: 96518518cc ("netfilter: add nftables") Cc: stable@vger.kernel.org Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 870dcc31c0cf47cb15a568ade4168dc644b3ccfb) Signed-off-by: Lee Jones <joneslee@google.com> Change-Id: I4a76c2be021867c923684f0034d4564f7797b48b		2023-09-20 14:37:55 +00:00
..
6lowpan	net: 6lowpan: constify lowpan_nhc structures	2022-06-09 21:53:28 +02:00
9p	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-20 12:35:08 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:33:02 +01:00
8021q	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
appletalk	net: remove noblock parameter from skb_recv_datagram()	2022-04-06 13:45:26 +01:00
atm	net/atm: fix proc_mpc_write incorrect return value	2022-10-15 11:08:36 +01:00
ax25	ax25: move from strlcpy with unused retval to strscpy	2022-08-22 17:55:50 -07:00
batman-adv	ANDROID: always add the struct wireless_dev * to struct net_device	2023-05-12 15:37:37 +00:00
bluetooth	UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb	2023-08-24 08:29:01 +00:00
bpf	Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"	2023-03-17 08:50:32 +01:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	net: bridge: switchdev: don't notify FDB entries with "master dynamic"	2023-04-26 14:28:35 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	UPSTREAM: can: isotp: isotp_sendmsg(): fix return error fix on TX path	2023-07-26 09:56:38 +00:00
ceph	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
core	ANDROID: GKI: Export four symbols in file net/core/net-trace.c	2023-09-06 09:46:47 +00:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-03 08:01:55 -08:00
dccp	UPSTREAM: dccp: Call inet6_destroy_sock() via sk->sk_destruct().	2023-05-16 17:26:14 +00:00
dns_resolver
dsa	net: dsa: tag_brcm: legacy: fix daisy-chained switches	2023-03-30 12:49:09 +02:00
ethernet	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
ethtool	ethtool: reset #lanes when lanes is omitted	2023-04-13 16:55:24 +02:00
hsr	hsr: ratelimit only when errors are printed	2023-04-06 12:10:58 +02:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife
ipv4	UPSTREAM: tcp: deny tcp_disconnect() when threads are waiting	2023-06-14 23:02:42 +00:00
ipv6	UPSTREAM: ipv{4,6}/raw: fix output xfrm lookup wrt protocol	2023-06-07 14:24:50 +00:00
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:33:50 +01:00
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	xfrm: Fix oops in __xfrm_state_delete()	2022-11-22 07:14:55 +01:00
l2tp	UPSTREAM: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-05-16 14:09:57 +00:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-15 14:27:24 -07:00
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
mac80211	Merge 6.1.24 into android14-6.1	2023-04-22 08:52:25 +00:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-05 09:53:08 +01:00
mctp	net: mctp: purge receive queues on sk destruction	2023-02-06 08:06:34 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:59:53 +01:00
mptcp	UPSTREAM: inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-05-16 14:09:57 +00:00
ncsi	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netfilter	UPSTREAM: netfilter: nf_tables: prevent OOB access in nft_byteorder_eval	2023-09-20 14:37:55 +00:00
netlabel	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink	netlink: annotate lockless accesses to nlk->max_recvmsg_len	2023-04-13 16:55:24 +02:00
netrom	netrom: Fix use-after-free caused by accept on already connected socket	2023-02-09 11:28:06 +01:00
nfc	UPSTREAM: net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-09-04 12:09:23 +01:00
nsh
openvswitch	net: openvswitch: fix race on port output	2023-04-20 12:35:09 +02:00
packet	packet: do not set TP_STATUS_CSUM_VALID on CHECKSUM_COMPLETE	2022-11-29 08:30:18 -08:00
phonet	net: remove noblock parameter from recvmsg() entities	2022-04-12 15:00:25 +02:00
psample	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-20 12:35:09 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-10 09:33:02 +01:00
rfkill	rfkill: make new event layout opt-in	2022-03-18 13:09:17 +02:00
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:59:42 +01:00
rxrpc	rxrpc: Fix missing unlock in rxrpc_do_sendmsg()	2022-12-31 13:32:55 +01:00
sched	UPSTREAM: net/sched: sch_hfsc: Ensure inner classes have fsc curve	2023-09-18 17:02:00 +01:00
sctp	UPSTREAM: inet: Add IP_LOCAL_PORT_RANGE socket option	2023-06-07 14:24:50 +00:00
smc	net/smc: fix deadlock triggered by cancel_delayed_work_syn()	2023-03-22 13:33:47 +01:00
strparser	strparser: pad sk_skb_cb to avoid straddling cachelines	2022-07-08 18:38:44 -07:00
sunrpc	sunrpc: only free unix grouplist after RCU settles	2023-04-13 16:55:23 +02:00
switchdev	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
tipc	UPSTREAM: tipc: check the bearer min mtu properly when setting it by netlink	2023-06-14 16:40:59 +00:00
tls	net: tls: fix device-offloaded sendpage straddling records	2023-03-17 08:50:26 +01:00
unix	UPSTREAM: af_unix: Fix null-ptr-deref in unix_stream_sendpage().	2023-09-12 15:01:22 +01:00
vmw_vsock	This is the 6.1.2 stable release	2023-01-18 18:44:34 +00:00
wireless	FROMGIT: wifi: nl80211: Add support for randomizing TA of auth and deauth frames	2023-05-11 05:22:29 +00:00
x25	net/x25: Fix to not accept on connected socket	2023-02-09 11:28:13 +01:00
xdp	xsk: Add missing overflow check in xdp_umem_reg	2023-03-30 12:49:02 +02:00
xfrm	FROMGIT: xfrm: Check if_id in inbound policy/secpath match	2023-05-12 16:23:38 +00:00
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
Kconfig	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
socket.c	net: avoid double iput when sock_alloc_file fails	2023-03-10 09:34:34 +01:00
sysctl_net.c	sections: move and rename core_kernel_data() to is_kernel_core_data()	2021-11-09 10:02:50 -08:00
TEST_MAPPING	ANDROID: align include/net, net/ TEST_MAPPING config with platform	2021-09-15 18:14:38 +00:00