Subash Abhinov Kasiviswanathan
89fcbb564f
netfilter: xt_socket: Restore mark from full sockets only
An out of bounds error was detected on an ARM64 target with
Android based kernel 4.9. This occurs while trying to
restore mark on a skb from an inet request socket.
BUG: KASAN: slab-out-of-bounds in socket_match.isra.2+0xc8/0x1f0 net/netfilter/xt_socket.c:248
Read of size 4 at addr ffffffc06a8d824c by task syz-fuzzer/1532
CPU: 7 PID: 1532 Comm: syz-fuzzer Tainted: G W O 4.9.41+ #1
Call trace:
[<ffffff900808d2f8>] dump_backtrace+0x0/0x440 arch/arm64/kernel/traps.c:76
[<ffffff900808d760>] show_stack+0x28/0x38 arch/arm64/kernel/traps.c:226
[<ffffff90085f7dc8>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffff90085f7dc8>] dump_stack+0xe4/0x134 lib/dump_stack.c:51
[<ffffff900830f358>] print_address_description+0x68/0x258 mm/kasan/report.c:248
[<ffffff900830f770>] kasan_report_error mm/kasan/report.c:347 [inline]
[<ffffff900830f770>] kasan_report.part.2+0x228/0x2f0 mm/kasan/report.c:371
[<ffffff900830fdec>] kasan_report+0x5c/0x70 mm/kasan/report.c:372
[<ffffff900830de98>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
[<ffffff900830de98>] __asan_load4+0x88/0xa0 mm/kasan/kasan.c:740
[<ffffff90097498f8>] socket_match.isra.2+0xc8/0x1f0 net/netfilter/xt_socket.c:248
[<ffffff9009749a5c>] socket_mt4_v1_v2_v3+0x3c/0x48 net/netfilter/xt_socket.c:272
[<ffffff90097f7e4c>] ipt_do_table+0x54c/0xad8 net/ipv4/netfilter/ip_tables.c:311
[<ffffff90097fcf14>] iptable_mangle_hook+0x6c/0x220 net/ipv4/netfilter/iptable_mangle.c:90
...
Allocated by task 1532:
save_stack_trace_tsk+0x0/0x2a0 arch/arm64/kernel/stacktrace.c:131
save_stack_trace+0x28/0x38 arch/arm64/kernel/stacktrace.c:215
save_stack mm/kasan/kasan.c:495 [inline]
set_track mm/kasan/kasan.c:507 [inline]
kasan_kmalloc+0xd8/0x188 mm/kasan/kasan.c:599
kasan_slab_alloc+0x14/0x20 mm/kasan/kasan.c:537
slab_post_alloc_hook mm/slab.h:417 [inline]
slab_alloc_node mm/slub.c:2728 [inline]
slab_alloc mm/slub.c:2736 [inline]
kmem_cache_alloc+0x14c/0x2e8 mm/slub.c:2741
reqsk_alloc include/net/request_sock.h:87 [inline]
inet_reqsk_alloc+0x4c/0x238 net/ipv4/tcp_input.c:6236
tcp_conn_request+0x2b0/0xea8 net/ipv4/tcp_input.c:6341
tcp_v4_conn_request+0xe0/0x100 net/ipv4/tcp_ipv4.c:1256
tcp_rcv_state_process+0x384/0x18a8 net/ipv4/tcp_input.c:5926
tcp_v4_do_rcv+0x2f0/0x3e0 net/ipv4/tcp_ipv4.c:1430
tcp_v4_rcv+0x1278/0x1350 net/ipv4/tcp_ipv4.c:1709
ip_local_deliver_finish+0x174/0x3e0 net/ipv4/ip_input.c:216
v1->v2: Change socket_mt6_v1_v2_v3() as well as mentioned by Eric
v2->v3: Put the correct fixes tag
Fixes: 01555e74bd ("netfilter: xt_socket: add XT_SOCKET_RESTORESKMARK flag")
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-09-26 20:04:34 +02:00
..
2017-09-04 19:05:16 -04:00
2017-06-20 13:30:14 -04:00
2017-06-26 23:13:22 -04:00
2017-06-16 11:48:40 -04:00
2017-08-09 22:43:50 -07:00
2017-07-04 22:35:19 +01:00
2017-08-09 16:28:45 -07:00
2017-09-09 17:56:05 -07:00
2017-09-05 11:51:47 -07:00
2017-07-01 07:39:08 -07:00
2017-08-09 16:57:38 -07:00
2017-09-19 20:34:29 +02:00
2017-09-22 20:31:29 -07:00
2017-08-09 16:57:38 -07:00
2017-08-31 11:43:47 -07:00
2017-09-03 17:08:42 -07:00
2017-09-05 11:53:34 -07:00
2017-06-16 11:48:40 -04:00
2017-08-22 13:40:23 -07:00
2017-09-05 20:03:35 -07:00
2017-09-22 20:33:17 -07:00
2017-09-19 16:44:02 -07:00
2017-07-04 22:35:17 +01:00
2017-07-03 02:31:22 -07:00
2017-09-01 17:42:05 -07:00
2017-08-15 20:23:23 -07:00
2017-09-25 14:44:41 -07:00
2017-07-04 22:35:16 +01:00
2017-07-04 22:35:15 +01:00
2017-09-06 15:22:02 +02:00
2017-06-07 15:53:24 -04:00
2017-08-09 16:57:38 -07:00
2017-09-05 09:11:45 -07:00
2017-09-26 20:04:34 +02:00
2017-09-06 21:22:54 -07:00
2017-07-04 22:35:17 +01:00
2017-06-23 00:38:31 +02:00
2017-08-29 15:16:52 -07:00
2017-09-12 20:37:31 -07:00
2017-09-20 13:57:19 -07:00
2017-08-09 16:57:38 -07:00
2017-06-16 11:48:39 -04:00
2017-08-09 16:57:38 -07:00
2017-09-07 20:07:13 -07:00
2017-06-13 11:07:51 +02:00
2017-09-05 14:39:17 -07:00
2017-09-21 15:13:52 -07:00
2017-09-15 14:51:15 -07:00
2017-09-21 15:31:03 -07:00
2017-08-24 21:57:50 -07:00
2017-09-11 22:01:44 -07:00
2017-08-07 14:48:48 -07:00
2017-09-06 21:25:52 -07:00
2017-09-14 09:55:21 -07:00
2017-08-21 17:06:42 -07:00
2017-08-28 15:38:18 -07:00
2017-09-18 22:51:07 +02:00
2017-08-03 09:13:51 -07:00
2017-09-01 17:42:05 -07:00
2017-09-20 15:36:18 -07:00
2017-09-04 13:25:20 +02:00
2017-08-29 15:16:52 -07:00
2017-08-16 11:27:52 -07:00