Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 29e38801 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: fix use-after-free when deleting compat expressions 



nft_compat ops do not have static storage duration, unlike all other
expressions.

When nf_tables_expr_destroy() returns, expr->ops might have been
free'd already, so we need to store next address before calling
expression destructor.

For same reason, we can't deref match pointer after nft_xt_put().

This can be easily reproduced by adding msleep() before
nft_match_destroy() returns.

Fixes: 0ca743a5 ("netfilter: nf_tables: add compatibility layer for x_tables")
Reported-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0fbcc5b5

net/netfilter/nf_tables_api.c

+3 −2
Original line number Diff line number Diff line
@@ -2457,7 +2457,7 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk, 
static void nf_tables_rule_destroy(const struct nft_ctx *ctx,

				   struct nft_rule *rule)

{

	struct nft_expr *expr;

	struct nft_expr *expr, *next;



	/*

	 * Careful: some expressions might not be initialized in case this
@@ -2465,8 +2465,9 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx, 
	 */

	expr = nft_expr_first(rule);

	while (expr != nft_expr_last(rule) && expr->ops) {

		next = nft_expr_next(expr);

		nf_tables_expr_destroy(ctx, expr);

		expr = nft_expr_next(expr);

		expr = next;

	}

	kfree(rule);

}

net/netfilter/nft_compat.c

+2 −1
Original line number Diff line number Diff line
@@ -520,6 +520,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, 
		    void *info)

{

	struct xt_match *match = expr->ops->data;

	struct module *me = match->me;

	struct xt_mtdtor_param par;



	par.net = ctx->net;
@@ -530,7 +531,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, 
		par.match->destroy(&par);



	if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))

		module_put(match->me);

		module_put(me);

}



static void