| Message ID | 20230209125831.2674811-1-Igor.A.Artemiev@mcst.ru (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [lvc-project] netfilter: xt_recent: Fix attempt to update removed entry | expand |
Igor Artemiev <Igor.A.Artemiev@mcst.ru> wrote: > When both --remove and --update flag are specified, there's a code > path at which the entry to be updated is removed beforehand, > that leads to kernel crash. Update entry, if --remove flag > don't specified. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. How did you manage to do this? --update and --remove are supposed to be mutually exclusive.
On Thursday 2023-02-09 16:07, Florian Westphal wrote: >Igor Artemiev <Igor.A.Artemiev@mcst.ru> wrote: >> When both --remove and --update flag are specified, there's a code >> path at which the entry to be updated is removed beforehand, >> that leads to kernel crash. Update entry, if --remove flag >> don't specified. >> >> Found by Linux Verification Center (linuxtesting.org) with SVACE. > >How did you manage to do this? --update and --remove are supposed >to be mutually exclusive. I suppose the exclusivity is only checked at the iptables command-line and neverwhere else.
Jan Engelhardt <jengelh@inai.de> wrote: > On Thursday 2023-02-09 16:07, Florian Westphal wrote: > > >Igor Artemiev <Igor.A.Artemiev@mcst.ru> wrote: > >> When both --remove and --update flag are specified, there's a code > >> path at which the entry to be updated is removed beforehand, > >> that leads to kernel crash. Update entry, if --remove flag > >> don't specified. > >> > >> Found by Linux Verification Center (linuxtesting.org) with SVACE. > > > >How did you manage to do this? --update and --remove are supposed > >to be mutually exclusive. > > I suppose the exclusivity is only checked at the iptables command-line > and neverwhere else. Removing the userspace check gives me an -EINVAL from checkentry.
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c index 7ddb9a78e3fc..189a413aa9d8 100644 --- a/net/netfilter/xt_recent.c +++ b/net/netfilter/xt_recent.c @@ -315,7 +315,8 @@ recent_mt(const struct sk_buff *skb, struct xt_action_param *par) } if (info->check_set & XT_RECENT_SET || - (info->check_set & XT_RECENT_UPDATE && ret)) { + (info->check_set & XT_RECENT_UPDATE && ret && + !(info->check_set & XT_RECENT_REMOVE))) { recent_entry_update(t, e); e->ttl = ttl; }
When both --remove and --update flag are specified, there's a code path at which the entry to be updated is removed beforehand, that leads to kernel crash. Update entry, if --remove flag don't specified. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Igor Artemiev <Igor.A.Artemiev@mcst.ru> Fixes: 404bdbfd242c ("[NETFILTER]: recent match: replace by rewritten version") --- net/netfilter/xt_recent.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)