| Message ID | 20240725192822.4478-1-kuniyu@amazon.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | netfilter: iptables: Fix null-ptr-deref in ip6?table_nat_table_init(). | expand |
Kuniyuki Iwashima <kuniyu@amazon.com> wrote: > We had a report that iptables-restore sometimes triggered null-ptr-deref > at boot time. > > The problem is that iptable_nat_table_init() is exposed to user space too > early and accesses net->gen->ptr[iptable_nat_net_ops.id] before allocated. Right, the other xtables don't have a pernet id, but nat needs this because of the nf_nat_core -> iptable_nat dependency. Reviewed-by: Florian Westphal <fw@strlen.de>
On Thu, Jul 25, 2024 at 12:28:19PM -0700, Kuniyuki Iwashima wrote: > We had a report that iptables-restore sometimes triggered null-ptr-deref > at boot time. > > The problem is that iptable_nat_table_init() is exposed to user space too > early and accesses net->gen->ptr[iptable_nat_net_ops.id] before allocated. > > Patch 1 fixes the issue in iptable_nat, and patch 2 applies the same fix > to ip6table_nat. Series applied and PR sent to netdev including these fixes, thanks.
We had a report that iptables-restore sometimes triggered null-ptr-deref at boot time. The problem is that iptable_nat_table_init() is exposed to user space too early and accesses net->gen->ptr[iptable_nat_net_ops.id] before allocated. Patch 1 fixes the issue in iptable_nat, and patch 2 applies the same fix to ip6table_nat. Kuniyuki Iwashima (2): netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). net/ipv4/netfilter/iptable_nat.c | 18 ++++++++++-------- net/ipv6/netfilter/ip6table_nat.c | 14 +++++++++----- 2 files changed, 19 insertions(+), 13 deletions(-)