Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1614968
| From | Denys Fedoryshchenko <nuclearcat@nuclearcat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 |
| Date | 2017-04-03 10:20 +0200 |
| Message-ID | <ts5ns-4l0-19@gated-at.bofh.it> (permalink) |
| References | (5 earlier) <trMNQ-mF-5@gated-at.bofh.it> <trMXv-rp-5@gated-at.bofh.it> <trR18-30F-5@gated-at.bofh.it> <trRkt-3oq-1@gated-at.bofh.it> <trRua-3sA-17@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On 2017-04-02 20:26, Eric Dumazet wrote:
> On Sun, 2017-04-02 at 10:14 -0700, Eric Dumazet wrote:
>
>> Could that be that netfilter does not abort earlier if TCP header is
>> completely wrong ?
>>
>
> Yes, I wonder if this patch would be better, unless we replicate the
> th->doff sanity check in all netfilter modules dissecting TCP frames.
>
> diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
> index
> ade024c90f4f129a7c384e9e1cbfdb8ffe73065f..8cb4eadd5ba1c20e74bc27ee52a0bc36a5b26725
> 100644
> --- a/net/netfilter/xt_tcpudp.c
> +++ b/net/netfilter/xt_tcpudp.c
> @@ -103,11 +103,11 @@ static bool tcp_mt(const struct sk_buff *skb,
> struct xt_action_param *par)
> if (!NF_INVF(tcpinfo, XT_TCP_INV_FLAGS,
> (((unsigned char *)th)[13] & tcpinfo->flg_mask) ==
> tcpinfo->flg_cmp))
> return false;
> + if (th->doff * 4 < sizeof(_tcph)) {
> + par->hotdrop = true;
> + return false;
> + }
> if (tcpinfo->option) {
> - if (th->doff * 4 < sizeof(_tcph)) {
> - par->hotdrop = true;
> - return false;
> - }
> if (!tcp_find_option(tcpinfo->option, skb, par->thoff,
> th->doff*4 - sizeof(_tcph),
> tcpinfo->invflags & XT_TCP_INV_OPTION,
I modified patch a little as:
if (th->doff * 4 < sizeof(_tcph)) {
par->hotdrop = true;
WARN_ON_ONCE(!tcpinfo->option);
return false;
}
And it did triggered WARN once at morning, and didn't hit KASAN. I will
run for a while more, to see if it is ok, and then if stable, will try
to enable SFQ again.
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Denys Fedoryshchenko <nuclearcat@nuclearcat.com> - 2017-04-02 09:50 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-02 13:30 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Florian Westphal <fw@strlen.de> - 2017-04-02 13:50 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Denys Fedoryshchenko <nuclearcat@nuclearcat.com> - 2017-04-02 14:00 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-02 14:00 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-02 14:30 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Denys Fedoryshchenko <nuclearcat@nuclearcat.com> - 2017-04-02 14:30 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-02 14:40 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Denys Fedoryshchenko <nuclearcat@nuclearcat.com> - 2017-04-02 19:00 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-02 19:20 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-02 19:30 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Denys Fedoryshchenko <nuclearcat@nuclearcat.com> - 2017-04-03 10:20 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-03 14:10 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Denys Fedoryshchenko <nuclearcat@nuclearcat.com> - 2017-04-03 14:20 +0200
Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8 Eric Dumazet <eric.dumazet@gmail.com> - 2017-04-03 14:30 +0200
csiph-web