| Message ID | 20210610182032.28096-1-pablo@netfilter.org |
|---|---|
| State | Changes Requested |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [nf,1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing | expand |
Hi Pablo,
I love your patch! Yet something to improve:
[auto build test ERROR on nf/master]
url: https://github.com/0day-ci/linux/commits/Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: i386-randconfig-s001-20210615 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce:
# apt-get install sparse
# sparse version: v0.6.3-341-g8af24329-dirty
# https://github.com/0day-ci/linux/commit/3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
git checkout 3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
# save the attached .config to linux build tree
make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' W=1 ARCH=i386
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
net/netfilter/nft_exthdr.c: In function 'nft_exthdr_ipv6_eval':
>> net/netfilter/nft_exthdr.c:45:6: error: 'skb' undeclared (first use in this function)
45 | if (skb->protocol != htons(ETH_P_IPV6))
| ^~~
net/netfilter/nft_exthdr.c:45:6: note: each undeclared identifier is reported only once for each function it appears in
vim +/skb +45 net/netfilter/nft_exthdr.c
35
36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
37 struct nft_regs *regs,
38 const struct nft_pktinfo *pkt)
39 {
40 struct nft_exthdr *priv = nft_expr_priv(expr);
41 u32 *dest = ®s->data[priv->dreg];
42 unsigned int offset = 0;
43 int err;
44
> 45 if (skb->protocol != htons(ETH_P_IPV6))
46 goto err;
47
48 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
49 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
50 nft_reg_store8(dest, err >= 0);
51 return;
52 } else if (err < 0) {
53 goto err;
54 }
55 offset += priv->offset;
56
57 dest[priv->len / NFT_REG32_SIZE] = 0;
58 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
59 goto err;
60 return;
61 err:
62 regs->verdict.code = NFT_BREAK;
63 }
64
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Hi Pablo,
I love your patch! Yet something to improve:
[auto build test ERROR on nf/master]
url: https://github.com/0day-ci/linux/commits/Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: arm-randconfig-r001-20210615 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project 64720f57bea6a6bf033feef4a5751ab9c0c3b401)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install arm cross compiling tool for clang build
# apt-get install binutils-arm-linux-gnueabi
# https://github.com/0day-ci/linux/commit/3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
git checkout 3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> net/netfilter/nft_exthdr.c:45:6: error: use of undeclared identifier 'skb'
if (skb->protocol != htons(ETH_P_IPV6))
^
1 error generated.
vim +/skb +45 net/netfilter/nft_exthdr.c
35
36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
37 struct nft_regs *regs,
38 const struct nft_pktinfo *pkt)
39 {
40 struct nft_exthdr *priv = nft_expr_priv(expr);
41 u32 *dest = ®s->data[priv->dreg];
42 unsigned int offset = 0;
43 int err;
44
> 45 if (skb->protocol != htons(ETH_P_IPV6))
46 goto err;
47
48 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
49 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
50 nft_reg_store8(dest, err >= 0);
51 return;
52 } else if (err < 0) {
53 goto err;
54 }
55 offset += priv->offset;
56
57 dest[priv->len / NFT_REG32_SIZE] = 0;
58 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
59 goto err;
60 return;
61 err:
62 regs->verdict.code = NFT_BREAK;
63 }
64
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Hi Pablo,
I love your patch! Yet something to improve:
[auto build test ERROR on nf/master]
url: https://github.com/0day-ci/linux/commits/Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
base: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git master
config: x86_64-randconfig-a013-20210615 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project 64720f57bea6a6bf033feef4a5751ab9c0c3b401)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install x86_64 cross compiling tool for clang build
# apt-get install binutils-x86-64-linux-gnu
# https://github.com/0day-ci/linux/commit/3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pablo-Neira-Ayuso/netfilter-nft_exthdr-check-for-IPv6-packet-before-further-processing/20210616-144640
git checkout 3e2206f7e73972c0cb8a3b6b8a8e0b636a959c96
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
>> net/netfilter/nft_exthdr.c:45:6: error: use of undeclared identifier 'skb'
if (skb->protocol != htons(ETH_P_IPV6))
^
1 error generated.
vim +/skb +45 net/netfilter/nft_exthdr.c
35
36 static void nft_exthdr_ipv6_eval(const struct nft_expr *expr,
37 struct nft_regs *regs,
38 const struct nft_pktinfo *pkt)
39 {
40 struct nft_exthdr *priv = nft_expr_priv(expr);
41 u32 *dest = ®s->data[priv->dreg];
42 unsigned int offset = 0;
43 int err;
44
> 45 if (skb->protocol != htons(ETH_P_IPV6))
46 goto err;
47
48 err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
49 if (priv->flags & NFT_EXTHDR_F_PRESENT) {
50 nft_reg_store8(dest, err >= 0);
51 return;
52 } else if (err < 0) {
53 goto err;
54 }
55 offset += priv->offset;
56
57 dest[priv->len / NFT_REG32_SIZE] = 0;
58 if (skb_copy_bits(pkt->skb, offset, dest, priv->len) < 0)
59 goto err;
60 return;
61 err:
62 regs->verdict.code = NFT_BREAK;
63 }
64
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c index 7f705b5c09de..d8f03175879f 100644 --- a/net/netfilter/nft_exthdr.c +++ b/net/netfilter/nft_exthdr.c @@ -44,6 +44,9 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, unsigned int offset = 0; int err; + if (skb->protocol != htons(ETH_P_IPV6)) + goto err; + err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); if (priv->flags & NFT_EXTHDR_F_PRESENT) { nft_reg_store8(dest, err >= 0);
ipv6_find_hdr() does not validate that this is an IPv6 packet. Add a sanity check for calling ipv6_find_hdr() to make sure an IPv6 packet is passed for parsing. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nft_exthdr.c | 3 +++ 1 file changed, 3 insertions(+)