Taehee Yoo b71534583f netfilter: nf_tables: fix NULL pointer dereference on nft_ct_helper_obj_dump() ... In the nft_ct_helper_obj_dump(), always priv->helper4 is dereferenced. But if family is ipv6, priv->helper6 should be dereferenced. Steps to reproduces: #test.nft table ip6 filter { ct helper ftp { type "ftp" protocol tcp } chain input { type filter hook input priority 4; ct helper set "ftp" } } %nft -f test.nft %nft list ruleset we can see the below messages: [ 916.286233] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 916.294777] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 916.302613] Modules linked in: nft_objref nf_conntrack_sip nf_conntrack_snmp nf_conntrack_broadcast nf_conntrack_ftp nft_ct nf_conntrack nf_tables nfnetlink [last unloaded: nfnetlink] [ 916.318758] CPU: 1 PID: 2093 Comm: nft Not tainted 4.17.0-rc4+ #181 [ 916.326772] Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 07/08/2015 [ 916.338773] RIP: 0010:strlen+0x1a/0x90 [ 916.342781] RSP: 0018:ffff88010ff0f2f8 EFLAGS: 00010292 [ 916.346773] RAX: dffffc0000000000 RBX: ffff880119b26ee8 RCX: ffff88010c150038 [ 916.354777] RDX: 0000000000000002 RSI: ffff880119b26ee8 RDI: 0000000000000010 [ 916.362773] RBP: 0000000000000010 R08: 0000000000007e88 R09: ffff88010c15003c [ 916.370773] R10: ffff88010c150037 R11: ffffed002182a007 R12: ffff88010ff04040 [ 916.378779] R13: 0000000000000010 R14: ffff880119b26f30 R15: ffff88010ff04110 [ 916.387265] FS: 00007f57a1997700(0000) GS:ffff88011b800000(0000) knlGS:0000000000000000 [ 916.394785] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 916.402778] CR2: 00007f57a0ac80f0 CR3: 000000010ff02000 CR4: 00000000001006e0 [ 916.410772] Call Trace: [ 916.414787] nft_ct_helper_obj_dump+0x94/0x200 [nft_ct] [ 916.418779] ? nft_ct_set_eval+0x560/0x560 [nft_ct] [ 916.426771] ? memset+0x1f/0x40 [ 916.426771] ? __nla_reserve+0x92/0xb0 [ 916.434774] ? memcpy+0x34/0x50 [ 916.434774] nf_tables_fill_obj_info+0x484/0x860 [nf_tables] [ 916.442773] ? __nft_release_basechain+0x600/0x600 [nf_tables] [ 916.450779] ? lock_acquire+0x193/0x380 [ 916.454771] ? lock_acquire+0x193/0x380 [ 916.458789] ? nf_tables_dump_obj+0x148/0xcb0 [nf_tables] [ 916.462777] nf_tables_dump_obj+0x5f0/0xcb0 [nf_tables] [ 916.470769] ? __alloc_skb+0x30b/0x500 [ 916.474779] netlink_dump+0x752/0xb50 [ 916.478775] __netlink_dump_start+0x4d3/0x750 [ 916.482784] nf_tables_getobj+0x27a/0x930 [nf_tables] [ 916.490774] ? nft_obj_notify+0x100/0x100 [nf_tables] [ 916.494772] ? nf_tables_getobj+0x930/0x930 [nf_tables] [ 916.502579] ? nf_tables_dump_flowtable_done+0x70/0x70 [nf_tables] [ 916.506774] ? nft_obj_notify+0x100/0x100 [nf_tables] [ 916.514808] nfnetlink_rcv_msg+0x8ab/0xa86 [nfnetlink] [ 916.518771] ? nfnetlink_rcv_msg+0x550/0xa86 [nfnetlink] [ 916.526782] netlink_rcv_skb+0x23e/0x360 [ 916.530773] ? nfnetlink_bind+0x200/0x200 [nfnetlink] [ 916.534778] ? debug_check_no_locks_freed+0x280/0x280 [ 916.542770] ? netlink_ack+0x870/0x870 [ 916.546786] ? ns_capable_common+0xf4/0x130 [ 916.550765] nfnetlink_rcv+0x172/0x16c0 [nfnetlink] [ 916.554771] ? sched_clock_local+0xe2/0x150 [ 916.558774] ? sched_clock_cpu+0x144/0x180 [ 916.566575] ? lock_acquire+0x380/0x380 [ 916.570775] ? sched_clock_local+0xe2/0x150 [ 916.574765] ? nfnetlink_net_init+0x130/0x130 [nfnetlink] [ 916.578763] ? sched_clock_cpu+0x144/0x180 [ 916.582770] ? lock_acquire+0x193/0x380 [ 916.590771] ? lock_acquire+0x193/0x380 [ 916.594766] ? lock_acquire+0x380/0x380 [ 916.598760] ? netlink_deliver_tap+0x262/0xa60 [ 916.602766] ? lock_acquire+0x193/0x380 [ 916.606766] netlink_unicast+0x3ef/0x5a0 [ 916.610771] ? netlink_attachskb+0x630/0x630 [ 916.614763] netlink_sendmsg+0x72a/0xb00 [ 916.618769] ? netlink_unicast+0x5a0/0x5a0 [ 916.626766] ? _copy_from_user+0x92/0xc0 [ 916.630773] __sys_sendto+0x202/0x300 [ 916.634772] ? __ia32_sys_getpeername+0xb0/0xb0 [ 916.638759] ? lock_acquire+0x380/0x380 [ 916.642769] ? lock_acquire+0x193/0x380 [ 916.646761] ? finish_task_switch+0xf4/0x560 [ 916.650763] ? __schedule+0x582/0x19a0 [ 916.655301] ? __sched_text_start+0x8/0x8 [ 916.655301] ? up_read+0x1c/0x110 [ 916.655301] ? __do_page_fault+0x48b/0xaa0 [ 916.655301] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 916.655301] __x64_sys_sendto+0xdd/0x1b0 [ 916.655301] do_syscall_64+0x96/0x3d0 [ 916.655301] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 916.655301] RIP: 0033:0x7f57a0ff5e03 [ 916.655301] RSP: 002b:00007fff6367e0a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 916.655301] RAX: ffffffffffffffda RBX: 00007fff6367f1e0 RCX: 00007f57a0ff5e03 [ 916.655301] RDX: 0000000000000020 RSI: 00007fff6367e110 RDI: 0000000000000003 [ 916.655301] RBP: 00007fff6367e100 R08: 00007f57a0ce9160 R09: 000000000000000c [ 916.655301] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff6367e110 [ 916.655301] R13: 0000000000000020 R14: 00007f57a153c610 R15: 0000562417258de0 [ 916.655301] Code: ff ff ff 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 fa 53 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df 48 89 fd 48 83 ec 08 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f [ 916.655301] RIP: strlen+0x1a/0x90 RSP: ffff88010ff0f2f8 [ 916.771929] ---[ end trace 1065e048e72479fe ]--- [ 916.777204] Kernel panic - not syncing: Fatal exception [ 916.778158] Kernel Offset: 0x14000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Signed-off-by: Taehee Yoo <ap420073@gmail.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2018-05-17 13:03:46 +02:00
..
6lowpan	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
9p	net/9p: fix spelling mistake: "suspsend" -> "suspend"	2018-05-10 15:23:50 -04:00
802	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00
8021q	vlan: also check phy_driver ts_info for vlan's real device	2018-04-01 20:53:50 -04:00
appletalk	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
atm	net: atm: Fix potential Spectre v1	2018-05-04 12:52:47 -04:00
ax25	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-04-01 19:49:34 -04:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth	2018-04-08 17:19:15 -04:00
bpf	bpf: fix null pointer deref in bpf_prog_test_run_xdp	2018-02-01 07:43:56 -08:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2018-05-13 20:28:47 -04:00
caif	net: caif: fix spelling mistake "UKNOWN" -> "UNKNOWN"	2018-04-19 13:37:10 -04:00
can	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
ceph	libceph: add osd_req_op_extent_osd_data_bvecs()	2018-05-10 10:15:05 +02:00
core	ethtool: fix a potential missing-check bug	2018-05-01 14:18:47 -04:00
dcb	rtnetlink: make rtnl_register accept a flags parameter	2017-08-09 16:57:38 -07:00
dccp	dccp: fix tasklet usage	2018-05-03 15:14:57 -04:00
decnet	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
dns_resolver	KEYS: DNS: limit the length of option strings	2018-04-17 15:17:41 -04:00
dsa	net: dsa: Discard frames from unused ports	2018-04-08 10:34:49 -04:00
ethernet	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
hsr	net: hsr: Convert timers to use timer_setup()	2017-10-25 13:00:27 +09:00
ieee802154	net: ieee802154: 6lowpan: fix frag reassembly	2018-04-23 20:56:24 +02:00
ife	net: sched: ife: check on metadata length	2018-04-22 21:12:00 -04:00
ipv4	tcp: purge write queue in tcp_connect_init()	2018-05-16 12:18:00 -04:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2018-05-13 20:28:47 -04:00
iucv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-03-23 11:31:58 -04:00
kcm	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
key	af_key: Always verify length of provided sadb_key	2018-04-09 07:06:38 +02:00
l2tp	l2tp: check sockaddr length in pppol2tp_connect()	2018-04-23 21:10:43 -04:00
l3mdev
lapb	treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts	2017-11-21 16:35:54 -08:00
llc	llc: better deal with too small mtu	2018-05-08 00:11:40 -04:00
mac80211	mac80211: use timeout from the AddBA response instead of the request	2018-05-07 20:35:15 +02:00
mac802154	net/mac802154: disambiguate mac80215 vs mac802154 trace events	2018-03-28 22:55:18 +02:00
mpls	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
ncsi	net/ncsi: check for null return from call to nla_nest_start	2018-03-27 10:38:26 -04:00
netfilter	netfilter: nf_tables: fix NULL pointer dereference on nft_ct_helper_obj_dump()	2018-05-17 13:03:46 +02:00
netlabel	netlabel: If PF_INET6, check sk_buff ip header version	2018-02-14 14:01:41 -05:00
netlink	net/netlink: make sure the headers line up actual value output	2018-05-04 13:00:57 -04:00
netrom	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-02-19 18:46:11 -05:00
nsh	nsh: fix infinite loop	2018-05-04 12:54:38 -04:00
openvswitch	openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found	2018-05-04 12:51:02 -04:00
packet	packet: in packet_snd start writing at link layer allocation	2018-05-13 20:19:27 -04:00
phonet	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00
psample	MAINTAINERS: Update Yotam's E-mail	2017-11-01 12:19:03 +09:00
qrtr	net: qrtr: add MODULE_ALIAS_NETPROTO macro	2018-04-17 09:58:00 -04:00
rds	rds: do not leak kernel memory to user land	2018-05-03 11:26:14 -04:00
rfkill	rfkill: gpio: fix memory leak in probe error path	2018-05-07 15:01:40 +02:00
rose	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
rxrpc	rxrpc: Trace UDP transmission failure	2018-05-10 23:26:01 +01:00
sched	net/sched: fix refcnt leak in the error path of tcf_vlan_init()	2018-05-16 14:41:44 -04:00
sctp	sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg	2018-05-10 17:48:36 -04:00
smc	net/smc: check for missing nlattrs in SMC_PNETID messages	2018-05-14 16:40:45 -04:00
strparser	strparser: Do not call mod_delayed_work with a timeout of LONG_MAX	2018-04-22 21:09:16 -04:00
sunrpc	NFS client fixes for Linux 4.17-rc4	2018-05-11 13:56:43 -07:00
switchdev	net: bridge: Add/del switchdev object on host join/leave	2017-11-10 13:41:40 +09:00
tipc	tipc: fix one byte leak in tipc_sk_set_orig_addr()	2018-05-10 17:28:39 -04:00
tls	net/tls: Fix connection stall on partial tls record	2018-05-07 23:47:58 -04:00
unix	af_unix: remove redundant lockdep class	2018-04-04 11:13:40 -04:00
vmw_vsock	VSOCK: make af_vsock.ko removable again	2018-04-17 09:44:30 -04:00
wimax	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
wireless	nl80211: Free connkeys on external authentication failure	2018-04-20 09:58:03 +02:00
x25	net: Use octal not symbolic permissions	2018-03-26 12:07:48 -04:00
xfrm	xfrm: Fix warning in xfrm6_tunnel_net_exit.	2018-04-16 07:50:09 +02:00
compat.c	net: support compat 64-bit time in {s,g}etsockopt	2018-04-27 19:46:06 -04:00
Kconfig	Staging/IIO patches for 4.16-rc1	2018-02-01 09:51:57 -08:00
Makefile	ipx: move Novell IPX protocol support into staging	2017-11-28 13:55:00 +01:00
socket.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2018-04-05 11:56:35 -07:00
sysctl_net.c	net: Drop pernet_operations::async	2018-03-27 13:18:09 -04:00