Taehee Yoo 9beceb54fa netfilter: x_tables: Fix use-after-free in ipt_do_table. ... If verdict is NF_STOLEN in the SYNPROXY target, the skb is consumed. However, ipt_do_table() always tries to get ip header from the skb. So that, KASAN triggers the use-after-free message. We can reproduce this message using below command. # iptables -I INPUT -p tcp -j SYNPROXY --mss 1460 [ 193.542265] BUG: KASAN: use-after-free in ipt_do_table+0x1405/0x1c10 [ ... ] [ 193.578603] Call Trace: [ 193.581590] <IRQ> [ 193.584107] dump_stack+0x68/0xa0 [ 193.588168] print_address_description+0x78/0x290 [ 193.593828] ? ipt_do_table+0x1405/0x1c10 [ 193.598690] kasan_report+0x230/0x340 [ 193.603194] __asan_report_load2_noabort+0x19/0x20 [ 193.608950] ipt_do_table+0x1405/0x1c10 [ 193.613591] ? rcu_read_lock_held+0xae/0xd0 [ 193.618631] ? ip_route_input_rcu+0x27d7/0x4270 [ 193.624348] ? ipt_do_table+0xb68/0x1c10 [ 193.629124] ? do_add_counters+0x620/0x620 [ 193.634234] ? iptable_filter_net_init+0x60/0x60 [ ... ] After this patch, only when verdict is XT_CONTINUE, ipt_do_table() tries to get ip header. Also arpt_do_table() is modified because it has same bug. Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2017-07-31 20:24:09 +02:00
..
6lowpan	6lowpan: Don't set IFF_NO_QUEUE	2017-04-12 22:02:40 +02:00
9p	sched/wait: Rename wait_queue_t => wait_queue_entry_t	2017-06-20 12:18:27 +02:00
802	net: introduce __skb_put_[zero, data, u8]	2017-06-20 13:30:14 -04:00
8021q	net: add netlink_ext_ack argument to rtnl_link_ops.validate	2017-06-26 23:13:22 -04:00
appletalk	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
atm	net, atm: convert eg_cache_entry.use from atomic_t to refcount_t	2017-07-04 22:35:16 +01:00
ax25	net, ax25: convert ax25_cb.refcount from atomic_t to refcount_t	2017-07-04 22:35:19 +01:00
batman-adv	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-07-05 12:31:59 -07:00
bpf	bpf: Align packet data properly in program testing framework.	2017-05-02 11:46:28 -04:00
bridge	net: bridge: fix dest lookup when vlan proto doesn't match	2017-07-14 08:19:23 -07:00
caif	net: convert sock.sk_wmem_alloc from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
can	networking: introduce and use skb_put_data()	2017-06-16 11:48:37 -04:00
ceph	libceph: osd_state is 32 bits wide in luminous	2017-07-07 17:25:19 +02:00
core	netpoll: shut up a kernel warning on refcount	2017-07-14 08:16:59 -07:00
dcb	dcb: enforce minimum length on IEEE_APPS attribute	2017-05-21 13:42:33 -04:00
dccp	dccp: make const array error_code static	2017-07-13 09:24:02 -07:00
decnet	net, decnet: convert dn_fib_info.fib_clntref from atomic_t to refcount_t	2017-07-04 22:35:15 +01:00
dns_resolver	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
dsa	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
ethernet	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
hsr	net: add netlink_ext_ack argument to rtnl_link_ops.newlink	2017-06-26 23:13:21 -04:00
ieee802154	net: add netlink_ext_ack argument to rtnl_link_ops.validate	2017-06-26 23:13:22 -04:00
ife	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
ipv4	netfilter: x_tables: Fix use-after-free in ipt_do_table.	2017-07-31 20:24:09 +02:00
ipv6	ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()	2017-07-18 11:22:51 -07:00
ipx	net, ipx: convert ipx_route.refcnt from atomic_t to refcount_t	2017-07-04 22:35:17 +01:00
irda	Merge branch 'work.memdup_user' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-07-05 16:05:24 -07:00
iucv	iucv: Convert sk_wmem_alloc accesses to refcount_t.	2017-07-03 02:31:22 -07:00
kcm	net: convert sock.sk_wmem_alloc from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
key	net, xfrm: convert xfrm_policy.refcnt from atomic_t to refcount_t	2017-07-04 22:35:18 +01:00
l2tp	net, l2tp: convert l2tp_session.ref_count from atomic_t to refcount_t	2017-07-04 22:35:15 +01:00
l3mdev	net: ipv6: Remove l3mdev_get_saddr6	2016-09-10 23:12:53 -07:00
lapb	net, lapb: convert lapb_cb.refcnt from atomic_t to refcount_t	2017-07-04 22:35:16 +01:00
llc	net, llc: convert llc_sap.refcnt from atomic_t to refcount_t	2017-07-04 22:35:15 +01:00
mac80211	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
mac802154	net: Fix inconsistent teardown and release of private netdev state.	2017-06-07 15:53:24 -04:00
mpls	mpls: fix uninitialized in_label var warning in mpls_getroute	2017-07-08 11:26:41 +01:00
ncsi	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
netfilter	netfilter: nft_compat: check extension hook mask only if set	2017-07-19 11:53:30 +02:00
netlabel	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
netlink	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
netrom	net, netrom: convert nr_node.refcount from atomic_t to refcount_t	2017-07-04 22:35:17 +01:00
nfc	NFC: Add sockaddr length checks before accessing sa_family in bind handlers	2017-06-23 00:38:31 +02:00
openvswitch	openvswitch: Fix for force/commit action failures	2017-07-15 14:40:21 -07:00
packet	net/packet: Fix Tx queue selection for AF_PACKET	2017-07-14 08:20:28 -07:00
phonet	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
psample	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
qrtr	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
rds	rds: tcp: use sock_create_lite() to create the accept socket	2017-07-08 11:16:16 +01:00
rfkill	net: rfkill: gpio: Switch to devm_acpi_dev_add_driver_gpios()	2017-06-13 11:07:51 +02:00
rose	net: Work around lockdep limitation in sockets that use sockets	2017-03-09 18:23:27 -08:00
rxrpc	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
sched	net sched actions: rename act_get_notify() to tcf_get_notify()	2017-07-14 08:52:33 -07:00
sctp	sctp: fix an array overflow when all ext chunks are set	2017-07-14 09:05:10 -07:00
smc	net/smc: Add warning about remote memory exposure	2017-05-16 14:49:43 -04:00
strparser	strparser: destroy workqueue on module exit	2017-03-03 20:43:26 -08:00
sunrpc	net, sunrpc: convert gss_upcall_msg.count from atomic_t to refcount_t	2017-07-04 22:35:17 +01:00
switchdev	net: switchdev: Change notifier chain to be atomic	2017-06-08 14:16:24 -04:00
tipc	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
tls	TLS: Fix length check in do_tls_getsockopt_tx()	2017-07-06 10:58:19 +01:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-07-05 12:31:59 -07:00
vmw_vsock	net: manual clean code which call skb_put_[data:zero]	2017-06-20 13:30:15 -04:00
wimax	genetlink: mark families as __ro_after_init	2016-10-27 16:16:09 -04:00
wireless	netlink validation fixes for nl80211	2017-07-07 11:35:55 +01:00
x25	net, x25: convert x25_neigh.refcnt from atomic_t to refcount_t	2017-07-04 22:35:18 +01:00
xfrm	net, xfrm: convert sec_path.refcnt from atomic_t to refcount_t	2017-07-04 22:35:18 +01:00
Kconfig	tls: kernel TLS support	2017-06-15 12:12:40 -04:00
Makefile	tls: kernel TLS support	2017-06-15 12:12:40 -04:00
compat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00
socket.c	Merge branch 'work.misc-set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-07-05 13:13:32 -07:00
sysctl_net.c	sysctl: Remove dead register_sysctl_root	2017-04-16 23:42:49 -05:00