Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c58dd2dd authored Apr 04, 2014 by Thomas Graf Committed by Pablo Neira Ayuso Apr 05, 2014

netfilter: Can't fail and free after table replacement



All xtables variants suffer from the defect that the copy_to_user()
to copy the counters to user memory may fail after the table has
already been exchanged and thus exposed. Return an error at this
point will result in freeing the already exposed table. Any
subsequent packet processing will result in a kernel panic.

We can't copy the counters before exposing the new tables as we
want provide the counter state after the old table has been
unhooked. Therefore convert this into a silent error.

Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 2fec6bb6

net/bridge/netfilter/ebtables.c

+2 −3

Original line number	Original line	Diff line number	Diff line
	@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net net, struct ebt_replace repl,
	if (repl->num_counters &&		if (repl->num_counters &&
	copy_to_user(repl->counters, counterstmp,		copy_to_user(repl->counters, counterstmp,
	repl->num_counters * sizeof(struct ebt_counter))) {		repl->num_counters * sizeof(struct ebt_counter))) {
	ret = -EFAULT;		/* Silent error, can't fail, new table is already in place */
			net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
	}		}
	else
	ret = 0;

	/* decrease module count and free resources */		/* decrease module count and free resources */
	EBT_ENTRY_ITERATE(table->entries, table->entries_size,		EBT_ENTRY_ITERATE(table->entries, table->entries_size,

net/ipv4/netfilter/arp_tables.c

+4 −2

Original line number	Original line	Diff line number	Diff line
	@@ -1044,8 +1044,10 @@ static int __do_replace(struct net net, const char name,

	xt_free_table_info(oldinfo);		xt_free_table_info(oldinfo);
	if (copy_to_user(counters_ptr, counters,		if (copy_to_user(counters_ptr, counters,
	sizeof(struct xt_counters) * num_counters) != 0)		sizeof(struct xt_counters) * num_counters) != 0) {
	ret = -EFAULT;		/* Silent error, can't fail, new table is already in place */
			net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n");
			}
	vfree(counters);		vfree(counters);
	xt_table_unlock(t);		xt_table_unlock(t);
	return ret;		return ret;

net/ipv4/netfilter/ip_tables.c

+4 −2

Original line number	Original line	Diff line number	Diff line
	@@ -1231,8 +1231,10 @@ __do_replace(struct net net, const char name, unsigned int valid_hooks,

	xt_free_table_info(oldinfo);		xt_free_table_info(oldinfo);
	if (copy_to_user(counters_ptr, counters,		if (copy_to_user(counters_ptr, counters,
	sizeof(struct xt_counters) * num_counters) != 0)		sizeof(struct xt_counters) * num_counters) != 0) {
	ret = -EFAULT;		/* Silent error, can't fail, new table is already in place */
			net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
			}
	vfree(counters);		vfree(counters);
	xt_table_unlock(t);		xt_table_unlock(t);
	return ret;		return ret;

net/ipv6/netfilter/ip6_tables.c

+4 −2

Original line number	Original line	Diff line number	Diff line
	@@ -1241,8 +1241,10 @@ __do_replace(struct net net, const char name, unsigned int valid_hooks,

	xt_free_table_info(oldinfo);		xt_free_table_info(oldinfo);
	if (copy_to_user(counters_ptr, counters,		if (copy_to_user(counters_ptr, counters,
	sizeof(struct xt_counters) * num_counters) != 0)		sizeof(struct xt_counters) * num_counters) != 0) {
	ret = -EFAULT;		/* Silent error, can't fail, new table is already in place */
			net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
			}
	vfree(counters);		vfree(counters);
	xt_table_unlock(t);		xt_table_unlock(t);
	return ret;		return ret;