netfilter: add back stackpointer size checks (57ebd808) · Commits · 戴 / test

The rationale for removing the check is only correct for rulesets generated by ip(6)tables. In iptables, a jump can only occur to a user-defined chain, i.e. because we size the stack based on number of user-defined chains we cannot exceed stack size. However, the underlying binary format has no such restriction, and the validation step only ensures that the jump target is a valid rule start point. IOW, its possible to build a rule blob that has no user-defined chains but does contain a jump. If this happens, no jump stack gets allocated and crash occurs because no jumpstack was allocated. Fixes: ("netfilter: xtables: don't save/restore jumpstack offset") Reported-by:

<syzbot+e783f671527912cd9403@syzkaller.appspotmail.com> Signed-off-by:

Florian Westphal <fw@strlen.de> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/ipv4/netfilter/arp_tables.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -252,6 +252,10 @@ unsigned int arpt_do_table(struct sk_buff *skb,
		}
		if (table_base + v
		!= arpt_next_entry(e)) {
		if (unlikely(stackidx >= private->stacksize)) {
		verdict = NF_DROP;
		break;
		}
		jumpstack[stackidx++] = e;
		}

net/ipv4/netfilter/ip_tables.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -330,8 +330,13 @@ ipt_do_table(struct sk_buff *skb,
		continue;
		}
		if (table_base + v != ipt_next_entry(e) &&
		!(e->ip.flags & IPT_F_GOTO))
		!(e->ip.flags & IPT_F_GOTO)) {
		if (unlikely(stackidx >= private->stacksize)) {
		verdict = NF_DROP;
		break;
		}
		jumpstack[stackidx++] = e;
		}

		e = get_entry(table_base, v);
		continue;

net/ipv6/netfilter/ip6_tables.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -352,6 +352,10 @@ ip6t_do_table(struct sk_buff *skb,
		}
		if (table_base + v != ip6t_next_entry(e) &&
		!(e->ipv6.flags & IP6T_F_GOTO)) {
		if (unlikely(stackidx >= private->stacksize)) {
		verdict = NF_DROP;
		break;
		}
		jumpstack[stackidx++] = e;
		}

Admin message