From patchwork Sun May 4 07:25:58 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Denys Fedoryshchenko X-Patchwork-Id: 345449 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id A496414018E for ; Sun, 4 May 2014 17:26:14 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752546AbaEDH0H (ORCPT ); Sun, 4 May 2014 03:26:07 -0400 Received: from hosting.visp.net.lb ([194.146.153.11]:38619 "EHLO hosting.visp.net.lb" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752429AbaEDH0F (ORCPT ); Sun, 4 May 2014 03:26:05 -0400 Received: from hosting.visp.net.lb (localhost [127.0.0.1]) by hosting.visp.net.lb (Postfix) with ESMTP id 5017D480AAE for ; Sun, 4 May 2014 10:25:59 +0300 (EEST) Received: by hosting.visp.net.lb (Postfix, from userid 65534) id 45515480AB4; Sun, 4 May 2014 10:25:59 +0300 (EEST) X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on vmail X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=UNPARSEABLE_RELAY autolearn=disabled version=3.3.2 Received: from webmail.visp.net.lb (localhost [127.0.0.1]) by hosting.visp.net.lb (Postfix) with ESMTP id 79BE44805D0; Sun, 4 May 2014 10:25:58 +0300 (EEST) Received: from xcIXPxWO7lyb6qq9tWxFsqIMnVnUir+u4iC+ImoAX3E= (B0F6/hYWMHyfW8bNDPuzADifKheAS0H5) by webmail.visp.net.lb with HTTP (HTTP/1.1 POST); Sun, 04 May 2014 10:25:58 +0300 MIME-Version: 1.0 Date: Sun, 04 May 2014 10:25:58 +0300 From: Denys Fedoryshchenko To: netdev@vger.kernel.org, kaber@trash.net, kadlec@blackhole.kfki.hu, Pablo Subject: Re: nft 2.0, NULL pointer dereference in 3.14.1 In-Reply-To: <52ee4b86089383eb7ae8d2bed17e6f8b@visp.net.lb> References: <52ee4b86089383eb7ae8d2bed17e6f8b@visp.net.lb> Message-ID: <3a97c044d7e99dc4bd3d6b8d36d79a01@visp.net.lb> X-Sender: nuclearcat@nuclearcat.com User-Agent: VISP Webmail/0.8.5 X-Virus-Scanned: ClamAV using ClamSMTP Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi I bit more debugging and found that problem is happening at: > sock = netlink_lookup(sock_net(ssk), ssk->sk_protocol, portid); ssk is NULL After checking, i noticed in nfnetlink.c nfnetlink_rcv_batch() function We have nskb->sk = oskb->sk; skb = nskb; I am matching condition ss = rcu_dereference_protected(table[subsys_id].subsys, lockdep_is_held(&table[subsys_id].mutex)); if (!ss) { And then nfnl_unlock(subsys_id); kfree_skb(nskb); return netlink_ack(skb, nlh, -EOPNOTSUPP); If i am not wrong, nskb same pointer as skb, so we are giving netlink_ack freed pointer? Is it "use after free()" ? If yes, then it seems attached patch fixing my issue. Please let me know, if it is ok and i should submit it. On 2014-04-19 10:36, Denys Fedoryshchenko wrote: > Hi > > While trying nft got kernel NULL dereference > extreme ~ # nft -v > nftables v0.2 (Support Edward Snowden) > extreme ~ # uname -a > Linux extreme 3.14.1-extreme-stable #1 SMP Sat Apr 19 10:23:48 EEST > 2014 x86_64 Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz GenuineIntel > GNU/Linux > > Command i tried (nothing else entered before it): > nft add rule filter icmp-chain counter > > kernel message: > [ 44.071555] Netfilter messages via NETLINK v0.30. > [ 44.072253] BUG: unable to handle kernel NULL pointer dereference > at 0000000000000119 > [ 44.072264] IP: [] > netlink_getsockbyportid+0xf/0x70 > [ 44.072272] PGD 7f2b74067 PUD 7f2b73067 PMD 0 > [ 44.072277] Oops: 0000 [#1] SMP > [ 44.072280] Modules linked in: nfnetlink ftdi_sio usbserial > usb_storage x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel > kvm iTCO_wdt iTCO_vendor_support mei_me mei lpc_ich mfd_core > [ 44.072301] CPU: 4 PID: 2573 Comm: nft Not tainted > 3.14.1-extreme-stable #1 > [ 44.072304] Hardware name: /DH87MC, BIOS > MCH8710H.86A.0154.2014.0123.1542 01/23/2014 > [ 44.072308] task: ffff8807f5195340 ti: ffff8807d4c36000 task.ti: > ffff8807d4c36000 > [ 44.072311] RIP: 0010:[] [] > netlink_getsockbyportid+0xf/0x70 > [ 44.072317] RSP: 0018:ffff8807d4c37a90 EFLAGS: 00010202 > [ 44.072319] RAX: 0000000000000000 RBX: 0000000000000000 RCX: > 0000000000000028 > [ 44.072322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: > 0000000000000000 > [ 44.072325] RBP: ffff8807d4c37a98 R08: 0000000000000000 R09: > ffff8807f85b0028 > [ 44.072328] R10: 00000000ffffffff R11: 0000000000000000 R12: > ffff8807f5de2900 > [ 44.072331] R13: 0000000000000000 R14: 0000000000000000 R15: > 0000000000000018 > [ 44.072335] FS: 00007fa028b25700(0000) GS:ffff88081ed00000(0000) > knlGS:0000000000000000 > [ 44.072338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 44.072341] CR2: 0000000000000119 CR3: 00000007f370d000 CR4: > 00000000001407e0 > [ 44.072343] DR0: 0000000000000000 DR1: 0000000000000000 DR2: > 0000000000000000 > [ 44.072346] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: > 0000000000000400 > [ 44.072349] Stack: > [ 44.072351] 0000000000000040 ffff8807d4c37ad0 ffffffff8171fd81 > 0000000000000000 > [ 44.072357] ffff8807f5de2900 ffff8807f5de2900 00000000ffffffa1 > ffff8807f85b1600 > [ 44.072363] ffff8807d4c37b08 ffffffff817206c9 ffff8807f85b1600 > ffff8807f5de3400 > [ 44.072369] Call Trace: > [ 44.072373] [] netlink_unicast+0x91/0x200 > [ 44.072377] [] netlink_ack+0x99/0x110 > [ 44.072381] [] nfnetlink_rcv+0x3c1/0x408 > [nfnetlink] > [ 44.072385] [] netlink_unicast+0xf3/0x200 > [ 44.072389] [] netlink_sendmsg+0x2ff/0x740 > [ 44.072394] [] ? __mmdrop+0x62/0x90 > [ 44.072398] [] sock_sendmsg+0x8b/0xc0 > [ 44.072403] [] ? > copy_user_enhanced_fast_string+0x5/0x10 > [ 44.072406] [] ? move_addr_to_kernel+0x2c/0x50 > [ 44.072410] [] ___sys_sendmsg+0x3c3/0x3d0 > [ 44.072415] [] ? handle_mm_fault+0xa9a/0xc60 > [ 44.072420] [] ? mmap_region+0x166/0x5a0 > [ 44.072424] [] ? __do_page_fault+0x1dc/0x510 > [ 44.072428] [] ? apparmor_capable+0x1c/0x60 > [ 44.072435] [] ? _raw_spin_unlock_bh+0x1a/0x20 > [ 44.072439] [] ? release_sock+0x106/0x150 > [ 44.072443] [] __sys_sendmsg+0x42/0x80 > [ 44.072446] [] SyS_sendmsg+0x12/0x20 > [ 44.072450] [] system_call_fastpath+0x1a/0x1f > [ 44.072453] Code: 41 5d 41 5e 5d c3 66 0f 1f 44 00 00 f0 ff 43 4c > eb e1 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 89 f2 48 89 e5 > 53 48 89 fb <0f> b6 b7 19 01 00 00 48 8b 7f 30 e8 f1 fe ff ff 48 89 c7 > 48 c7 > [ 44.072963] RIP [] > netlink_getsockbyportid+0xf/0x70 > [ 44.073253] RSP > [ 44.073524] CR2: 0000000000000119 > [ 44.074757] ---[ end trace f3a9846ab3cb7550 ]--- > > Please let me know if more information required. > Thanks! --- linux-3.14.2/net/netfilter/nfnetlink.c 2014-04-27 03:19:26.000000000 +0300 +++ linux-3.14.2-modified/net/netfilter/nfnetlink.c 2014-05-04 10:14:32.108299766 +0300 @@ -248,15 +248,15 @@ replay: #endif { nfnl_unlock(subsys_id); - kfree_skb(nskb); - return netlink_ack(skb, nlh, -EOPNOTSUPP); + netlink_ack(skb, nlh, -EOPNOTSUPP); + return kfree_skb(nskb); } } if (!ss->commit || !ss->abort) { nfnl_unlock(subsys_id); - kfree_skb(nskb); - return netlink_ack(skb, nlh, -EOPNOTSUPP); + netlink_ack(skb, nlh, -EOPNOTSUPP); + return kfree_skb(skb); } while (skb->len >= nlmsg_total_size(0)) {