Commit fa287557 authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge tag 'nf-24-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf 

Pablo Neira Ayuso says:

====================

This patchset contains Netfilter fixes for net:

1) syzkaller managed to triger UaF due to missing reference on netns in
   bpf infrastructure, from Florian Westphal.

2) Fix incorrect conversion from NFPROTO_UNSPEC to NFPROTO_{IPV4,IPV6}
   in the following xtables targets: MARK and NFLOG. Moreover, add
   missing

I have my half share in this mistake, I did not take the necessary time
to review this: For several years I have been struggling to keep working
on Netfilter, juggling a myriad of side consulting projects to stop
burning my own savings.

I have extended the iptables-tests.py test infrastructure to improve the
coverage of ip6tables and detect similar problems in the future.

This is a v2 including a extended PR with one more fix.

netfilter pull request 24-10-21

* tag 'nf-24-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: xtables: fix typo causing some targets not to load on IPv6
  netfilter: bpf: must hold reference on net namespace
====================

Link: https://patch.msgid.link/20241021094536.81487-1-pablo@netfilter.org


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents d95d9a31 306ed172

net/netfilter/nf_bpf_link.c

+4 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ static unsigned int nf_hook_run_bpf(void *bpf_prog, struct sk_buff *skb, 
struct bpf_nf_link {

	struct bpf_link link;

	struct nf_hook_ops hook_ops;

	netns_tracker ns_tracker;

	struct net *net;

	u32 dead;

	const struct nf_defrag_hook *defrag_hook;
@@ -120,6 +121,7 @@ static void bpf_nf_link_release(struct bpf_link *link) 
	if (!cmpxchg(&nf_link->dead, 0, 1)) {

		nf_unregister_net_hook(nf_link->net, &nf_link->hook_ops);

		bpf_nf_disable_defrag(nf_link);

		put_net_track(nf_link->net, &nf_link->ns_tracker);

	}

}
@@ -257,6 +259,8 @@ int bpf_nf_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) 
		return err;

	}



	get_net_track(net, &link->ns_tracker, GFP_KERNEL);



	return bpf_link_settle(&link_primer);

}

net/netfilter/xt_NFLOG.c

+1 −1
Original line number Diff line number Diff line
@@ -79,7 +79,7 @@ static struct xt_target nflog_tg_reg[] __read_mostly = { 
	{

		.name       = "NFLOG",

		.revision   = 0,

		.family     = NFPROTO_IPV4,

		.family     = NFPROTO_IPV6,

		.checkentry = nflog_tg_check,

		.destroy    = nflog_tg_destroy,

		.target     = nflog_tg,

net/netfilter/xt_TRACE.c

+1 −0
Original line number Diff line number Diff line
@@ -49,6 +49,7 @@ static struct xt_target trace_tg_reg[] __read_mostly = { 
		.target		= trace_tg,

		.checkentry	= trace_tg_check,

		.destroy	= trace_tg_destroy,

		.me		= THIS_MODULE,

	},

#endif

};

net/netfilter/xt_mark.c

+1 −1
Original line number Diff line number Diff line
@@ -62,7 +62,7 @@ static struct xt_target mark_tg_reg[] __read_mostly = { 
	{

		.name           = "MARK",

		.revision       = 2,

		.family         = NFPROTO_IPV4,

		.family         = NFPROTO_IPV6,

		.target         = mark_tg,

		.targetsize     = sizeof(struct xt_mark_tginfo2),

		.me             = THIS_MODULE,