From patchwork Sun Jan 28 15:41:39 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 866836 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="rIZWzKGw"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zTxhc5LRTz9sDB for ; Mon, 29 Jan 2018 02:41:52 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751998AbeA1Plp (ORCPT ); Sun, 28 Jan 2018 10:41:45 -0500 Received: from mail-pg0-f65.google.com ([74.125.83.65]:44451 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751733AbeA1Pln (ORCPT ); Sun, 28 Jan 2018 10:41:43 -0500 Received: by mail-pg0-f65.google.com with SMTP id m20so2563195pgc.11; Sun, 28 Jan 2018 07:41:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=srjUKr+zIssnfVrTGa3S0KaMDQIMYWjSZyao71ACXm8=; b=rIZWzKGwQDOfBMjZqmDlUwt5nhwazSglwLOhfTOa6LeGTHqkY8dUEd9/8lzWcsgDy1 dM8EQsKVbzlPTVsAOCRFlOjNTvdKnZQdI9dErPYPO2W5UqL1+fE71V+bHKVCyxU/KQ9H N+CawnCFd0ujfMD8toKmoig9qd0wRbMLgeFZ/u9PDHPzPNWpMy33RFkUa90uFh6ZzDBb Nnwjf7A3wSMV7P7/qaPV/sP94ECy8I2HjvsxwgrAG8WrAoNQSYybWK9XXgLsaK0OD9yG hoDI/+0bhYMFuOQrLL1VCwM2IURxZqV4ndCXsmhyBRm+MAMpusZM3GU7A4kmkA5+f5jp zSlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=srjUKr+zIssnfVrTGa3S0KaMDQIMYWjSZyao71ACXm8=; b=C9J4SLTNeEIaZIDt0BUTPKAV5Ix6ZuoANv7Vi1CFIlrmIZ4Nw+CIxZFOS5xI+FfXXC 9H0eUcmTg0l5E9nfNJv/UD4waPWO6gKstBIRdxtJJvOC24HJumeD8TqGFTVdrsYRs21y TVCWlDaejWvH1UM8aEvGZcB1+uRyEVAZPVlsLignXGUUojWK/F8KUdLYgxvZCOh9sBNk fcFJnfwov2/8GyBe0jhMmMjsPx4J3eJp9Vuni1tPXpmN8l9ig3rRKYVduiOKNI4isMSN qOmqcTnG68e9VI3286bMcFmBiTFKSDZ68GXWWBDUc9VLsw3IUvCDObk16Ig4ecVbd8zh 7rLA== X-Gm-Message-State: AKwxytdJoHN3vNScTMUdgyQqNuiTBnBNDqfsoauyzIU2J4s5L8rWKAzW PSetjDmUVrgyCwPB33GcMsZaiw== X-Google-Smtp-Source: AH8x226unO+1CKwe5v53yqekWuaqPGSKpv9FbDk6PhYb7HuKV+9SvZlJoe8s2QC4+s/gm+vc9yMlOQ== X-Received: by 10.98.47.193 with SMTP id v184mr23948735pfv.90.1517154102500; Sun, 28 Jan 2018 07:41:42 -0800 (PST) Received: from edumazet-glaptop3.lan (c-67-180-167-114.hsd1.ca.comcast.net. [67.180.167.114]) by smtp.googlemail.com with ESMTPSA id j125sm14900710pgc.29.2018.01.28.07.41.40 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sun, 28 Jan 2018 07:41:41 -0800 (PST) Message-ID: <1517154099.3715.77.camel@gmail.com> Subject: [PATCH net] netfilter: xt_hashlimit: do not allow empty names From: Eric Dumazet To: Pablo Neira Ayuso Cc: Jozsef Kadlecsik , Florian Westphal , netfilter-devel@vger.kernel.org, netdev Date: Sun, 28 Jan 2018 07:41:39 -0800 X-Mailer: Evolution 3.22.6-1+deb9u1 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet Syzbot reported a WARN() in proc_create_data() [1] Issue here is that xt_hashlimit does not check that user space provided an empty table name. [1] name len 0 WARNING: CPU: 0 PID: 3680 at fs/proc/generic.c:354 __proc_create+0x696/0x880 fs/proc/generic.c:354 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 3680 Comm: syzkaller464755 Not tainted 4.15.0-rc9+ #283 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 panic+0x1e4/0x41c kernel/panic.c:183 __warn+0x1dc/0x200 kernel/panic.c:547 report_bug+0x211/0x2d0 lib/bug.c:184 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178 fixup_bug arch/x86/kernel/traps.c:247 [inline] do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315 invalid_op+0x22/0x40 arch/x86/entry/entry_64.S:1096 RIP: 0010:__proc_create+0x696/0x880 fs/proc/generic.c:354 RSP: 0018:ffff8801d9607410 EFLAGS: 00010286 RAX: dffffc0000000008 RBX: 1ffff1003b2c0e87 RCX: ffffffff8159ebae RDX: 0000000000000000 RSI: 1ffff1003b284970 RDI: 0000000000000293 RBP: ffff8801d9607580 R08: 1ffff1003b2c0e15 R09: 0000000000000000 R10: ffff8801d96072c8 R11: 0000000000000000 R12: ffff8801d981ef28 R13: ffff8801d9607558 R14: 0000000000000000 R15: ffff8801d9607518 proc_create_data+0x76/0x180 fs/proc/generic.c:488 htable_create net/netfilter/xt_hashlimit.c:333 [inline] hashlimit_mt_check_common.isra.9+0xaee/0x1420 net/netfilter/xt_hashlimit.c:900 hashlimit_mt_check_v1+0x48d/0x640 net/netfilter/xt_hashlimit.c:926 xt_check_match+0x231/0x7d0 net/netfilter/x_tables.c:465 check_match net/ipv4/netfilter/ip_tables.c:479 [inline] find_check_match net/ipv4/netfilter/ip_tables.c:495 [inline] find_check_entry.isra.8+0x3fc/0xcb0 net/ipv4/netfilter/ip_tables.c:544 translate_table+0xed1/0x1610 net/ipv4/netfilter/ip_tables.c:730 do_replace net/ipv4/netfilter/ip_tables.c:1148 [inline] do_ipt_set_ctl+0x370/0x5f0 net/ipv4/netfilter/ip_tables.c:1682 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:115 ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1256 tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2875 sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2968 SYSC_setsockopt net/socket.c:1831 [inline] SyS_setsockopt+0x189/0x360 net/socket.c:1810 entry_SYSCALL_64_fastpath+0x29/0xa0 Signed-off-by: Eric Dumazet Reported-by: syzbot ---  net/netfilter/xt_hashlimit.c |    2 ++  1 file changed, 2 insertions(+) diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c index 5da8746f7b88ff4c9446f256e542e823a6a561b0..eae732e013df92a364b500645360d4606c283a75 100644 --- a/net/netfilter/xt_hashlimit.c +++ b/net/netfilter/xt_hashlimit.c @@ -894,6 +894,8 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par, return -ERANGE; } + if (!name[0]) + return -EINVAL; mutex_lock(&hashlimit_mutex); *hinfo = htable_find_get(net, name, par->family); if (*hinfo == NULL) {