Commit 97a0549b authored May 17, 2018 by Taehee Yoo Committed by Pablo Neira Ayuso May 23, 2018

netfilter: nft_meta: fix wrong value dereference in nft_meta_set_eval



In the nft_meta_set_eval, nftrace value is dereferenced as u32 from sreg.
But correct type is u8. so that sometimes incorrect value is dereferenced.

Steps to reproduce:

   %nft add table ip filter
   %nft add chain ip filter input { type filter hook input priority 4\; }
   %nft add rule ip filter input nftrace set 0
   %nft monitor

Sometimes, we can see trace messages.

   trace id 16767227 ip filter input packet: iif "enp2s0"
   ether saddr xx:xx:xx:xx:xx:xx ether daddr xx:xx:xx:xx:xx:xx
   ip saddr 192.168.0.1 ip daddr 255.255.255.255 ip dscp cs0
   ip ecn not-ect ip
   trace id 16767227 ip filter input rule nftrace set 0 (verdict continue)
   trace id 16767227 ip filter input verdict continue
   trace id 16767227 ip filter input

Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 94c752f9

net/netfilter/nft_meta.c

+8 −6

Original line number	Diff line number	Diff line
		@@ -234,7 +234,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
		struct sk_buff *skb = pkt->skb;
		u32 *sreg = &regs->data[meta->sreg];
		u32 value = *sreg;
		u8 pkt_type;
		u8 value8;

		switch (meta->key) {
		case NFT_META_MARK:
		@@ -244,15 +244,17 @@ void nft_meta_set_eval(const struct nft_expr *expr,
		skb->priority = value;
		break;
		case NFT_META_PKTTYPE:
		pkt_type = nft_reg_load8(sreg);
		value8 = nft_reg_load8(sreg);

		if (skb->pkt_type != pkt_type &&
		skb_pkt_type_ok(pkt_type) &&
		if (skb->pkt_type != value8 &&
		skb_pkt_type_ok(value8) &&
		skb_pkt_type_ok(skb->pkt_type))
		skb->pkt_type = pkt_type;
		skb->pkt_type = value8;
		break;
		case NFT_META_NFTRACE:
		skb->nf_trace = !!value;
		value8 = nft_reg_load8(sreg);

		skb->nf_trace = !!value8;
		break;
		default:
		WARN_ON(1);

Admin message