From patchwork Wed May 22 22:19:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1938068 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Vl5MD1Mzrz2020 for ; Thu, 23 May 2024 08:19:35 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1s9uIu-0004te-Pd; Wed, 22 May 2024 22:19:24 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1s9uIr-0004sp-Tc for kernel-team@lists.ubuntu.com; Wed, 22 May 2024 22:19:22 +0000 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 9CF193F65D for ; Wed, 22 May 2024 22:19:21 +0000 (UTC) Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-34eb54c888cso11501821f8f.3 for ; Wed, 22 May 2024 15:19:21 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716416361; x=1717021161; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=gXisiKndOO8Yrqx8Pm1Z2zFXtnI6fILaUV43m3X3PY4=; b=W1c/uRK8jkQPB988SvloKZmG1C4SE/C5XBPRUKXW3SZWz3GC8Ir1bW075hbOx4mfyh aIGX0qboJM061uZhAOmSMWDitlQYPf2Qtt5MDiWCvgiOGDI9BVcc73Xy3yNxQdmY5QPb 6CjRaDHs4CCl5YvPlKaHlvZcZSjkIo8cRKrTeXMZgDzGDJqJww03gPnI/1y+eXl2rgDO vj8OHN1KpqNN7vJZ7pCHVKGgbQazQ7m/t8ZtdVu1YCUgU5oQWvapOvHnSN9wPYS6dqft 0bqeC1Dd+AQHpU3olfIyxeHx/J0O5Hqwb8oWpMJiCwvUc979t+NhguMSh4BEXMScHKfj txFg== X-Gm-Message-State: AOJu0YyEmM9FnnRcIvM3zUMoBi2MSA1T7WMTfx1qLvItOT1Py1wfWXR8 r7CUo+ch5X8jBjvsAXn/kNQH1jceGgsHNDOkM4T35GS/jS+cTUsLyu7uBViFAGcBHhut6OPSv0i v3IMDj9qBOjK5RSoDd7ld9/OEQTz9BjyIFk7nqI83hMbx7i7WGEM5oOgUeNWKQSqGZcJdPKJqor 8ADyp25a18xA== X-Received: by 2002:a5d:6446:0:b0:34f:c7c8:5a12 with SMTP id ffacd0b85a97d-354d8ce454dmr3216997f8f.40.1716416361057; Wed, 22 May 2024 15:19:21 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGAoYCYcG8Rq5v30JKIefQcIvBSfdel69rObDnzdZ8XwPoi39VRyZJShBYIGz7c9PAVzpN5og== X-Received: by 2002:a5d:6446:0:b0:34f:c7c8:5a12 with SMTP id ffacd0b85a97d-354d8ce454dmr3216990f8f.40.1716416360779; Wed, 22 May 2024 15:19:20 -0700 (PDT) Received: from smtp.gmail.com ([2001:67c:1562:8007::aac:48f9]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3502b8a789asm35151233f8f.51.2024.05.22.15.19.19 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 May 2024 15:19:20 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][N/M/J][PATCH 1/1] netfilter: nft_set_pipapo: do not free live element Date: Wed, 22 May 2024 17:19:15 -0500 Message-Id: <20240522221915.30585-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240522221915.30585-1-bethany.jamison@canonical.com> References: <20240522221915.30585-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Florian Westphal [ Upstream commit 3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc ] Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms 1) nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated element. Removal happens in two steps, first we do a lookup for key k and return the to-be-removed element and mark it as inactive in the next generation. Then, in a second step, the element gets removed from the set/map. The _remove function does not work correctly if we have more than one element that share the same key. This can happen if we insert an element into a set when the set already holds an element with same key, but the element mapping to the existing key has timed out or is not active in the next generation. In such case its possible that removal will unmap the wrong element. If this happens, we will leak the non-deactivated element, it becomes unreachable. The element that got deactivated (and will be freed later) will remain reachable in the set data structure, this can result in a crash when such an element is retrieved during lookup (stale pointer). Add a check that the fully matching key does in fact map to the element that we have marked as inactive in the deactivation step. If not, we need to continue searching. Add a bug/warn trap at the end of the function as well, the remove function must not ever be called with an invisible/unreachable/non-existent element. v2: avoid uneeded temporary variable (Stefano) Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Pablo Neira Ayuso Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin (cherry picked from commit 14b001ba221136c15f894577253e8db535b99487 linux-6.8.y) CVE-2024-26924 Signed-off-by: Bethany Jamison --- net/netfilter/nft_set_pipapo.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index b3b282de802de..65c19ac028c82 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -2000,6 +2000,8 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, rules_fx = rules_f0; nft_pipapo_for_each_field(f, i, m) { + bool last = i == m->field_count - 1; + if (!pipapo_match_field(f, start, rules_fx, match_start, match_end)) break; @@ -2012,16 +2014,18 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, match_start += NFT_PIPAPO_GROUPS_PADDED_SIZE(f); match_end += NFT_PIPAPO_GROUPS_PADDED_SIZE(f); - } - if (i == m->field_count) { - priv->dirty = true; - pipapo_drop(m, rulemap); - return; + if (last && f->mt[rulemap[i].to].e == e) { + priv->dirty = true; + pipapo_drop(m, rulemap); + return; + } } first_rule += rules_f0; } + + WARN_ON_ONCE(1); /* elem_priv not found */ } /**