[-stable,4.x.y] netfilter: nf_nat_redirect: add missing NULL pointer check
diff mbox

Message ID 1446813886-5632-1-git-send-email-pablo@netfilter.org
State Awaiting Upstream
Delegated to: Pablo Neira
Headers show

Commit Message

Pablo Neira Ayuso Nov. 6, 2015, 12:44 p.m. 
From: Munehisa Kamata <kamatam@amazon.com>

[ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]

Commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT
redirect IPv4 to use it from nf_tables") has introduced a trivial logic
change which can result in the following crash.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
IP: [<ffffffffa033002d>] nf_nat_redirect_ipv4+0x2d/0xa0 [nf_nat_redirect]
PGD 3ba662067 PUD 3ba661067 PMD 0
Oops: 0000 [#1] SMP
Modules linked in: ipv6(E) xt_REDIRECT(E) nf_nat_redirect(E) xt_tcpudp(E) iptable_nat(E) nf_conntrack_ipv4(E) nf_defrag_ipv4(E) nf_nat_ipv4(E) nf_nat(E) nf_conntrack(E) ip_tables(E) x_tables(E) binfmt_misc(E) xfs(E) libcrc32c(E) evbug(E) evdev(E) psmouse(E) i2c_piix4(E) i2c_core(E) acpi_cpufreq(E) button(E) ext4(E) crc16(E) jbd2(E) mbcache(E) dm_mirror(E) dm_region_hash(E) dm_log(E) dm_mod(E)
CPU: 0 PID: 2536 Comm: ip Tainted: G            E   4.1.7-15.23.amzn1.x86_64 #1
Hardware name: Xen HVM domU, BIOS 4.2.amazon 05/06/2015
task: ffff8800eb438000 ti: ffff8803ba664000 task.ti: ffff8803ba664000
[...]
Call Trace:
 <IRQ>
 [<ffffffffa0334065>] redirect_tg4+0x15/0x20 [xt_REDIRECT]
 [<ffffffffa02e2e99>] ipt_do_table+0x2b9/0x5e1 [ip_tables]
 [<ffffffffa0328045>] iptable_nat_do_chain+0x25/0x30 [iptable_nat]
 [<ffffffffa031777d>] nf_nat_ipv4_fn+0x13d/0x1f0 [nf_nat_ipv4]
 [<ffffffffa0328020>] ? iptable_nat_ipv4_fn+0x20/0x20 [iptable_nat]
 [<ffffffffa031785e>] nf_nat_ipv4_in+0x2e/0x90 [nf_nat_ipv4]
 [<ffffffffa03280a5>] iptable_nat_ipv4_in+0x15/0x20 [iptable_nat]
 [<ffffffff81449137>] nf_iterate+0x57/0x80
 [<ffffffff814491f7>] nf_hook_slow+0x97/0x100
 [<ffffffff814504d4>] ip_rcv+0x314/0x400

unsigned int
nf_nat_redirect_ipv4(struct sk_buff *skb,
...
{
...
		rcu_read_lock();
		indev = __in_dev_get_rcu(skb->dev);
		if (indev != NULL) {
			ifa = indev->ifa_list;
			newdst = ifa->ifa_local; <---
		}
		rcu_read_unlock();
...
}

Before the commit, 'ifa' had been always checked before access. After the
commit, however, it could be accessed even if it's NULL. Interestingly,
this was once fixed in 2003.

http://marc.info/?l=netfilter-devel&m=106668497403047&w=2

In addition to the original one, we have seen the crash when packets that
need to be redirected somehow arrive on an interface which hasn't been
yet fully configured.

This change just reverts the logic to the old behavior to avoid the crash.

Fixes: 8b13eddfdf04 ("netfilter: refactor NAT redirect IPv4 to use it from nf_tables")
Cc: <stable@vger.kernel.org> # 4.1.x
Cc: <stable@vger.kernel.org> # 4.2.x
Cc: <stable@vger.kernel.org> # 4.3.x
Signed-off-by: Munehisa Kamata <kamatam@amazon.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_nat_redirect.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Greg KH Nov. 6, 2015, 5:08 p.m. | #1 
On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
> From: Munehisa Kamata <kamatam@amazon.com>
> 
> [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]

This isn't a valid git commit id in Linus's tree :(
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso Nov. 6, 2015, 5:26 p.m. | #2 
On Fri, Nov 06, 2015 at 09:08:58AM -0800, Greg KH wrote:
> On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
> > From: Munehisa Kamata <kamatam@amazon.com>
> > 
> > [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
> 
> This isn't a valid git commit id in Linus's tree :(

This is David's tree already:

http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc

So this should hit Linus tree soon.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Munehisa Kamata Jan. 18, 2016, 7:27 p.m. | #3 
Hi Greg,

This commit is already in Linus's tree. Could you please pick this up for 4.1.y?

Regards,
Munehisa

On 11/6/2015 9:26 AM, Pablo Neira Ayuso wrote:
> On Fri, Nov 06, 2015 at 09:08:58AM -0800, Greg KH wrote:
>> On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
>>> From: Munehisa Kamata <kamatam@amazon.com>
>>>
>>> [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
>>
>> This isn't a valid git commit id in Linus's tree :(
> 
> This is David's tree already:
> 
> http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc
> 
> So this should hit Linus tree soon.
> 
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso Jan. 18, 2016, 7:47 p.m. | #4 
On Mon, Jan 18, 2016 at 11:27:13AM -0800, Munehisa Kamata wrote:
> Hi Greg,
> 
> This commit is already in Linus's tree. Could you please pick this up for 4.1.y?

I submitted this twice... Last time I made it was this one:

http://patchwork.ozlabs.org/patch/544964/

Previous was rejected because it was not in Linus tree:

http://patchwork.ozlabs.org/patch/540946/

But the last attempt got no feedback...

> On 11/6/2015 9:26 AM, Pablo Neira Ayuso wrote:
> > On Fri, Nov 06, 2015 at 09:08:58AM -0800, Greg KH wrote:
> >> On Fri, Nov 06, 2015 at 01:44:43PM +0100, Pablo Neira Ayuso wrote:
> >>> From: Munehisa Kamata <kamatam@amazon.com>
> >>>
> >>> [ upstream commit 94f9cd81436c85d8c3a318ba92e236ede73752fc ]
> >>
> >> This isn't a valid git commit id in Linus's tree :(
> > 
> > This is David's tree already:
> > 
> > http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=94f9cd81436c85d8c3a318ba92e236ede73752fc
> > 
> > So this should hit Linus tree soon.
> > 
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso Jan. 18, 2016, 7:48 p.m. | #5 
On Mon, Jan 18, 2016 at 08:47:18PM +0100, Pablo Neira Ayuso wrote:
> On Mon, Jan 18, 2016 at 11:27:13AM -0800, Munehisa Kamata wrote:
> > Hi Greg,
> > 
> > This commit is already in Linus's tree. Could you please pick this up for 4.1.y?
> 
> I submitted this twice... Last time I made it was this one:
> 
> http://patchwork.ozlabs.org/patch/544964/
> 
> Previous was rejected because it was not in Linus tree:
> 
> http://patchwork.ozlabs.org/patch/540946/
> 
> But the last attempt got no feedback...

BTW, you can find all my -stable submissions here:

http://patchwork.ozlabs.org/project/netfilter-devel/list/?state=*&q=stable-
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Greg KH Jan. 19, 2016, 3:26 a.m. | #6 
On Mon, Jan 18, 2016 at 08:48:02PM +0100, Pablo Neira Ayuso wrote:
> On Mon, Jan 18, 2016 at 08:47:18PM +0100, Pablo Neira Ayuso wrote:
> > On Mon, Jan 18, 2016 at 11:27:13AM -0800, Munehisa Kamata wrote:
> > > Hi Greg,
> > > 
> > > This commit is already in Linus's tree. Could you please pick this up for 4.1.y?
> > 
> > I submitted this twice... Last time I made it was this one:
> > 
> > http://patchwork.ozlabs.org/patch/544964/
> > 
> > Previous was rejected because it was not in Linus tree:
> > 
> > http://patchwork.ozlabs.org/patch/540946/
> > 
> > But the last attempt got no feedback...
> 
> BTW, you can find all my -stable submissions here:
> 
> http://patchwork.ozlabs.org/project/netfilter-devel/list/?state=*&q=stable-

Relax, I am _way_ behind on stable patch work at the moment, should
hopefully dig out from the mess over the next week...

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox 

diff --git a/net/netfilter/nf_nat_redirect.c b/net/netfilter/nf_nat_redirect.c
index 97b75f9..d438698 100644
--- a/net/netfilter/nf_nat_redirect.c
+++ b/net/netfilter/nf_nat_redirect.c
@@ -55,7 +55,7 @@  nf_nat_redirect_ipv4(struct sk_buff *skb,
 
 		rcu_read_lock();
 		indev = __in_dev_get_rcu(skb->dev);
-		if (indev != NULL) {
+		if (indev && indev->ifa_list) {
 			ifa = indev->ifa_list;
 			newdst = ifa->ifa_local;
 		}