Commit 35177c68 authored by Qi Tang's avatar Qi Tang Committed by Pablo Neira Ayuso
Browse files

netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent 



ctnetlink_alloc_expect() allocates expectations from a non-zeroing
slab cache via nf_ct_expect_alloc().  When CTA_EXPECT_NAT is not
present in the netlink message, saved_addr and saved_proto are
never initialized.  Stale data from a previous slab occupant can
then be dumped to userspace by ctnetlink_exp_dump_expect(), which
checks these fields to decide whether to emit CTA_EXPECT_NAT.

The safe sibling nf_ct_expect_init(), used by the packet path,
explicitly zeroes these fields.

Zero saved_addr, saved_proto and dir in the else branch, guarded
by IS_ENABLED(CONFIG_NF_NAT) since these fields only exist when
NAT is enabled.

Confirmed by priming the expect slab with NAT-bearing expectations,
freeing them, creating a new expectation without CTA_EXPECT_NAT,
and observing that the ctnetlink dump emits a spurious
CTA_EXPECT_NAT containing stale data from the prior allocation.

Fixes: 076a0ca0 ("netfilter: ctnetlink: add NAT support for expectations")
Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarQi Tang <tpluszz77@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a242a9ae

net/netfilter/nf_conntrack_netlink.c

+6 −0
Original line number Diff line number Diff line
@@ -3588,6 +3588,12 @@ ctnetlink_alloc_expect(const struct nlattr * const cda[], struct nf_conn *ct, 
						 exp, nf_ct_l3num(ct));

		if (err < 0)

			goto err_out;

#if IS_ENABLED(CONFIG_NF_NAT)

	} else {

		memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));

		memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));

		exp->dir = 0;

#endif

	}

	return exp;

err_out: