Will McVicker
289fe546ea
netfilter: ctnetlink: add a range check for l3/l4 protonum ...
commit 1cc5ef91d2ff94d2bf2de3b3585423e8a1051cb6 upstream.
The indexes to the nf_nat_l[34]protos arrays come from userspace. So
check the tuple's family, e.g. l3num, when creating the conntrack in
order to prevent an OOB memory access during setup. Here is an example
kernel panic on 4.14.180 when userspace passes in an index greater than
NFPROTO_NUMPROTO.
Internal error: Oops - BUG: 0 [#1 ] PREEMPT SMP
Modules linked in:...
Process poc (pid: 5614, stack limit = 0x00000000a3933121)
CPU: 4 PID: 5614 Comm: poc Tainted: G S W O 4.14.180-g051355490483
Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM
task: 000000002a3dfffe task.stack: 00000000a3933121
pc : __cfi_check_fail+0x1c/0x24
lr : __cfi_check_fail+0x1c/0x24
...
Call trace:
__cfi_check_fail+0x1c/0x24
name_to_dev_t+0x0/0x468
nfnetlink_parse_nat_setup+0x234/0x258
ctnetlink_parse_nat_setup+0x4c/0x228
ctnetlink_new_conntrack+0x590/0xc40
nfnetlink_rcv_msg+0x31c/0x4d4
netlink_rcv_skb+0x100/0x184
nfnetlink_rcv+0xf4/0x180
netlink_unicast+0x360/0x770
netlink_sendmsg+0x5a0/0x6a4
___sys_sendmsg+0x314/0x46c
SyS_sendmsg+0xb4/0x108
el0_svc_naked+0x34/0x38
This crash is not happening since 5.4+, however, ctnetlink still
allows for creating entries with unsupported layer 3 protocol number.
Fixes: c1d10adb4a
2020-10-07 08:00:09 +02:00
netfilter: ipset: fix unaligned atomic access
2020-06-30 23:17:12 -04:00
ipvs: allow connection reuse for unconfirmed conntrack
2020-08-19 08:14:56 +02:00
jump_label: move 'asm goto' support test to Kconfig
2019-06-04 08:02:34 +02:00
netfilter: fix NETFILTER_XT_TARGET_TEE dependencies
2019-05-04 09:20:12 +02:00
netfilter: nf_tables: add tunnel support
2018-08-03 21:12:12 +02:00
netfilter: nf_conncount: fix argument order to find_next_bit
2019-01-22 21:40:29 +01:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: use nf_conntrack_helpers_register when possible
2017-06-19 19:13:21 +02:00
netfilter: check if the socket netns is correct.
2018-06-28 22:21:32 +09:00
netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
2020-05-20 08:18:43 +02:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: use kvmalloc_array to allocate memory for hashtable
2018-08-03 18:37:55 +02:00
netfilter: conntrack: include kmemleak.h for kmemleak_not_leak()
2018-04-17 10:59:43 +02:00
netfilter: nf_conntrack_ftp: Fix debug output
2019-09-21 07:17:01 +02:00
netfilter: nf_conntrack_h323: restore boundary check correctness
2019-06-15 11:54:05 +02:00
netfilter: move route indirection to struct nf_ipv6_ops
2018-01-08 18:01:26 +01:00
netfilter: use kvmalloc_array to allocate memory for hashtable
2018-08-03 18:37:55 +02:00
netfilter: add __exit mark to helper modules
2018-04-24 10:29:14 +02:00
netfilter: conntrack: mark extension structs as const
2017-04-26 09:30:22 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-03-30 11:41:18 -04:00
netfilter: ctnetlink: add a range check for l3/l4 protonum
2020-10-07 08:00:09 +02:00
netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
2020-06-03 08:19:49 +02:00
netfilter: fix nf_l4proto_log_invalid to log invalid packets
2019-05-16 19:41:24 +02:00
netfilter: conntrack: dccp, sctp: handle null timeout argument
2020-01-14 20:07:08 +01:00
netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT
2018-09-11 01:30:25 +02:00
netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too
2019-04-17 08:38:46 +02:00
netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT
2018-09-11 01:30:25 +02:00
netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT
2018-09-11 01:30:25 +02:00
netfilter: conntrack: allow sctp hearbeat after connection re-use
2020-09-17 13:45:24 +02:00
netfilter: conntrack: always store window size un-scaled
2019-08-16 10:12:44 +02:00
netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT
2018-09-11 01:30:25 +02:00
netfilter: add __exit mark to helper modules
2018-04-24 10:29:14 +02:00
netfilter: seqadj: re-load tcp header pointer after possible head reallocation
2019-01-13 09:50:57 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-05-06 21:51:37 -04:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-03-30 11:41:18 -04:00
netfilter: nf_conntrack: ct_cpu_seq_next should increase position index
2020-03-18 07:14:20 +01:00
netfilter: add __exit mark to helper modules
2018-04-24 10:29:14 +02:00
netfilter: cttimeout: decouple timeout policy from nfnetlink_cttimeout object
2018-08-07 17:14:15 +02:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: dup: resolve warnings about missing prototypes
2017-05-29 11:32:36 +02:00
netfilter: nf_flow_table: do not remove offload when other netns's interface is down
2020-01-27 14:49:59 +01:00
netfilter: nf_flow_table: move init code to nf_flow_table_core.c
2018-04-24 10:28:45 +02:00
netfilter: flowtable: reload ip{v6}h in nf_flow_tuple_ip{v6}
2020-04-02 15:28:19 +02:00
netfilter: core: export raw versions of add/delete hook functions
2018-05-23 09:14:05 +02:00
netfilter: nf_log: don't hold nf_log_mutex during user access
2018-06-26 16:48:40 +02:00
netfilter: check if the socket netns is correct.
2018-06-28 22:21:32 +09:00
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
netfilter: nat: nf_nat_mangle_{udp,tcp}_packet returns boolean
2017-04-06 22:01:38 +02:00
netfilter: nat: can't use dst_hold on noref dst
2019-01-13 09:50:59 +01:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: nat: never update the UDP checksum when it's 0
2020-05-14 07:57:23 +02:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: nat: merge nf_nat_redirect into nf_nat
2018-05-29 00:25:40 +02:00
netfilter: nf_nat_sip: fix RTP/RTCP source port translations
2019-12-05 09:20:31 +01:00
netfilter: nf_queue: enqueue skbs with NULL dst
2020-01-04 19:13:21 +01:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
netfilter: synproxy: synproxy_cpu_seq_next should increase position index
2020-03-18 07:14:20 +01:00
netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
2020-09-09 19:04:26 +02:00
netfilter: nf_tables: check the result of dereferencing base_chain->stats
2019-04-05 22:33:00 +02:00
netfilter: nf_tables: place all set backends in one single module
2018-07-06 19:31:53 +02:00
netfilter: nf_tables: Allow chain name of up to 255 chars
2017-07-31 20:41:57 +02:00
netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
2020-09-09 19:04:26 +02:00
netfilter: fix memory leaks on netlink_dump_start error
2018-08-16 19:37:00 +02:00
netfilter: nfnetlink_cthelper: unbreak userspace helper support
2020-06-03 08:19:47 +02:00
netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too
2019-04-17 08:38:46 +02:00
netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
2020-09-09 19:04:26 +02:00
netfilter: nf_osf: avoid passing pointer to local var
2020-05-14 07:57:23 +02:00
netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of ENOBUFS
2020-09-09 19:04:26 +02:00
netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
2020-01-12 12:17:09 +01:00
netfilter: nf_tables: simplify the basic expressions' init routine
2016-11-09 23:42:23 +01:00
netfilter: nf_tables: don't prevent event handler from device cleanup on netns exit
2018-08-16 19:37:03 +02:00
netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
2020-01-12 12:17:09 +01:00
netfilter: nft_compat: do not dump private area
2019-11-24 08:21:03 +01:00
netfilter: nft_connlimit: disable bh on garbage collection
2019-10-29 09:19:34 +01:00
netfilter: nf_tables: add destroy_clone expression
2018-06-03 00:02:11 +02:00
netfilter: nf_tables: rework ct timeout set support
2018-08-29 13:04:38 +02:00
netfilter: nf_tables: add packet duplication to the netdev family
2016-01-03 21:04:23 +01:00
netfilter: nf_tables: bogus EBUSY when deleting set after flush
2019-05-02 09:58:51 +02:00
netfilter: nf_tables: merge exthdr expression into nft core
2018-04-27 00:00:56 +02:00
netfilter: nft_fib: Support existence check
2017-03-13 13:45:36 +01:00
netfilter: nf_tables: use hook state from xt_action_param structure
2016-11-03 11:52:34 +01:00
netfilter: nf_tables: add fib expression to the netdev family
2017-07-31 19:01:40 +02:00
netfilter: nft_flow_offload: add entry to flowtable after confirmation
2020-01-27 14:50:43 +01:00
netfilter: nft_fwd_netdev: validate family and chain type
2020-04-02 15:28:19 +02:00
netfilter: nft_hash: fix symhash with modulus one
2019-08-16 10:12:44 +02:00
netfilter: nf_tables: unbind set in rule from commit path
2019-05-02 09:58:50 +02:00
netfilter: nft_limit: fix packet ratelimiting
2018-05-23 09:50:28 +02:00
netfilter: nf_tables: add NFT_LOGLEVEL_* enumeration and use it
2018-06-07 16:14:00 -04:00
netfilter: nf_tables: allow lookups in dynamic sets
2019-10-11 18:21:16 +02:00
netfilter: nf_tables: add single table list for all families
2018-01-10 15:32:08 +01:00
netfilter: nf_tables: handle meta/lookup with direct call
2018-07-30 11:52:02 +02:00
netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported
2020-06-22 09:05:14 +02:00
Revert "netfilter: nft_numgen: add map lookups for numgen random operations"
2018-11-27 16:13:02 +01:00
netfilter: nf_tables: bogus EBUSY in helper removal from transaction
2019-05-02 09:58:51 +02:00
netfilter: nft_osf: add missing check for DREG attribute
2020-01-29 16:43:21 +01:00
netfilter: nf_tables: fix destination register zeroing
2020-09-09 19:04:25 +02:00
netfilter: Remove exceptional & on function name
2017-04-07 18:24:47 +02:00
netfilter: nf_tables: add select_ops for stateful objects
2017-09-04 13:25:09 +02:00
netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
2020-01-12 12:17:09 +01:00
netfilter: nf_tables: add single table list for all families
2018-01-10 15:32:08 +01:00
netfilter: nf_tables: avoid BUG_ON usage
2019-11-20 18:46:50 +01:00
netfilter: nf_tables: validate the expr explicitly after init successfully
2017-03-06 18:22:12 +01:00
netfilter: nf_tables: merge rt expression into nft core
2018-04-27 00:00:55 +02:00
netfilter: nft_set: fix allocation size overflow in privsize callback.
2018-08-16 19:36:59 +02:00
netfilter: nft_set_hash: bogus element self comparison from deactivation path
2020-01-27 14:50:29 +01:00
netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start()
2020-05-20 08:18:44 +02:00
netfilter: nft_socket: fix erroneous socket assignment
2019-10-01 08:26:12 +02:00
netfilter: nft_tproxy: Fix port selector on Big Endian
2020-01-09 10:18:59 +01:00
netfilter: nft_tunnel: add missing attribute validation for tunnels
2020-03-18 07:14:24 +01:00
netfilter: utils: move nf_ip6_checksum* from ipv6 to utils
2018-07-16 17:51:48 +02:00
netfilter: x_tables: xt_mttg_seq_next should increase position index
2020-03-18 07:14:20 +01:00
netfilter: x_tables: use pr ratelimiting in matches/targets
2018-02-14 21:05:37 +01:00
audit: eliminate audit_enabled magic number comparison
2018-06-19 10:43:55 -04:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: xt_cgroup: shrink size of v2 path
2019-04-20 09:16:00 +02:00
netfilter: xt_checksum: ignore gso skbs
2018-08-24 09:58:16 +02:00
netfilter: xt_cluster: add dependency on conntrack module
2018-08-23 20:26:53 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: use PTR_ERR_OR_ZERO()
2018-07-30 14:07:09 +02:00
netfilter: xt_connmark: fix list corruption on rmmod
2018-06-12 19:35:52 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: cttimeout: decouple timeout policy from nfnetlink_cttimeout object
2018-08-07 17:14:15 +02:00
netfilter: x_tables: move hook state into xt_action_param structure
2016-11-03 10:56:21 +01:00
netfilter: x_tables: remove pr_info where possible
2018-02-14 21:05:33 +01:00
netfilter: x_tables: remove pr_info where possible
2018-02-14 21:05:33 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: xt_hashlimit: limit the max size of hashtable
2020-02-28 16:39:00 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: remove pr_info where possible
2018-02-14 21:05:33 +01:00
netfilter: x_tables: use pr ratelimiting in matches/targets
2018-02-14 21:05:37 +01:00
netfilter: xt_IDLETIMER: add sysfs filename checking routine
2018-11-27 16:13:03 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: fix missing timer initialization in xt_LED
2018-02-14 21:05:39 +01:00
netfilter: xt_limit: Spelling s/maxmum/maximum/
2018-03-05 23:15:50 +01:00
netfilter: x_tables: move hook state into xt_action_param structure
2016-11-03 10:56:21 +01:00
netfilter: xt_MARK: Add ARP support
2015-05-14 13:00:27 +02:00
netfilter: xt_multiport: Fix wrong unmatch result with multiple ports
2016-12-06 21:48:20 +01:00
netfilter: xt_nat: fix DNAT target for shifted portmap ranges
2018-11-13 11:08:20 -08:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
2019-09-21 07:16:55 +02:00
netfilter: xt_NFLOG: use nf_log_packet instead of nfulnl_log_packet.
2018-04-19 13:02:44 +02:00
netfilter: xt_NFQUEUE: use pr ratelimiting
2018-02-14 21:05:35 +01:00
netfilter: nfnetlink_osf: extract nfnetlink_subsystem code from xt_osf.c
2018-07-30 14:07:11 +02:00
netfilter: check if the socket netns is correct.
2018-06-28 22:21:32 +09:00
netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
2019-09-21 07:17:01 +02:00
netfilter: pkttype: unnecessary to check ipv6 multicast address
2017-01-18 20:32:43 +01:00
netfilter: x_tables: use pr ratelimiting in matches/targets
2018-02-14 21:05:37 +01:00
xtables: extend matches and targets with .usersize
2017-01-09 17:24:55 +01:00
netfilter: make xt_rateest hash table per net
2018-03-05 23:15:44 +01:00
netfilter: xt_RATEEST: remove netns exit routine
2018-12-17 09:24:31 +01:00
netfilter: xt_recent: recent_seq_next should increase position index
2020-03-18 07:14:20 +01:00
netfilter: add NAT support for shifted portmap ranges
2018-04-24 10:29:12 +02:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
sctp: remove the typedef sctp_chunkhdr_t
2017-07-01 09:08:41 -07:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: ipset: Limit max timeout value
2018-06-06 14:00:54 +02:00
netfilter: xt_socket: check sk before checking for netns.
2018-09-28 14:47:41 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
netfilter: x_tables: fix pointer leaks to userspace
2018-01-31 14:59:24 +01:00
netfilter: ebtables: Add string filter
2018-03-30 11:04:12 +02:00
netfilter: x_tables: use pr ratelimiting in all remaining spots
2018-02-14 21:05:38 +01:00
net: Change pseudohdr argument of inet_proto_csum_replace* to be a bool
2015-08-17 21:33:06 -07:00
netfilter: Convert FWINV<[foo]> macros and uses to NF_INVF
2016-07-03 10:55:07 +02:00
netfilter: xt_TEE: add missing code to get interface index in checkentry.
2019-03-13 14:02:40 -07:00
netfilter: Replace printk() with pr_*() and define pr_fmt()
2018-03-20 13:44:14 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
2018-07-20 22:28:28 -07:00
netfilter: xt_TRACE: add explicitly nf_logger_find_get call
2016-06-23 13:26:49 +02:00
289fe546ea