Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit 9ef0298a8e5730d9a46d640014c727f3b4152870

Authored by Jan Engelhardt
Committed by Patrick McHardy
1 parent ff75f40f44

netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values 

Like many other places, we have to check that the array index is
within allowed limits, or otherwise, a kernel oops and other nastiness
can ensue when we access memory beyond the end of the array.

[ 5954.115381] BUG: unable to handle kernel paging request at 0000004000000000
[ 5954.120014] IP:  __find_logger+0x6f/0xa0
[ 5954.123979]  nf_log_bind_pf+0x2b/0x70
[ 5954.123979]  nfulnl_recv_config+0xc0/0x4a0 [nfnetlink_log]
[ 5954.123979]  nfnetlink_rcv_msg+0x12c/0x1b0 [nfnetlink]
...

The problem goes back to v2.6.30-rc1~1372~1342~31 where nf_log_bind
was decoupled from nf_log_register.

Reported-by: Miguel Di Ciurcio Filho <miguel.filho@gmail.com>,
  via irc.freenode.net/#netfilter
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>

Showing 1 changed file with 4 additions and 0 deletions Inline Diff

net/netfilter/nf_log.c
Diff comments   View file @ 9ef0298
1 #include <linux/kernel.h> 1 #include <linux/kernel.h>
2 #include <linux/init.h> 2 #include <linux/init.h>
3 #include <linux/module.h> 3 #include <linux/module.h>
4 #include <linux/proc_fs.h> 4 #include <linux/proc_fs.h>
5 #include <linux/skbuff.h> 5 #include <linux/skbuff.h>
6 #include <linux/netfilter.h> 6 #include <linux/netfilter.h>
7 #include <linux/seq_file.h> 7 #include <linux/seq_file.h>
8 #include <net/protocol.h> 8 #include <net/protocol.h>
9 #include <net/netfilter/nf_log.h> 9 #include <net/netfilter/nf_log.h>
10 10
11 #include "nf_internals.h" 11 #include "nf_internals.h"
12 12
13 /* Internal logging interface, which relies on the real 13 /* Internal logging interface, which relies on the real
14 LOG target modules */ 14 LOG target modules */
15 15
16 #define NF_LOG_PREFIXLEN 128 16 #define NF_LOG_PREFIXLEN 128
17 #define NFLOGGER_NAME_LEN 64 17 #define NFLOGGER_NAME_LEN 64
18 18
19 static const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO] __read_mostly; 19 static const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO] __read_mostly;
20 static struct list_head nf_loggers_l[NFPROTO_NUMPROTO] __read_mostly; 20 static struct list_head nf_loggers_l[NFPROTO_NUMPROTO] __read_mostly;
21 static DEFINE_MUTEX(nf_log_mutex); 21 static DEFINE_MUTEX(nf_log_mutex);
22 22
23 static struct nf_logger *__find_logger(int pf, const char *str_logger) 23 static struct nf_logger *__find_logger(int pf, const char *str_logger)
24 { 24 {
25 struct nf_logger *t; 25 struct nf_logger *t;
26 26
27 list_for_each_entry(t, &nf_loggers_l[pf], list[pf]) { 27 list_for_each_entry(t, &nf_loggers_l[pf], list[pf]) {
28 if (!strnicmp(str_logger, t->name, strlen(t->name))) 28 if (!strnicmp(str_logger, t->name, strlen(t->name)))
29 return t; 29 return t;
30 } 30 }
31 31
32 return NULL; 32 return NULL;
33 } 33 }
34 34
35 /* return EEXIST if the same logger is registred, 0 on success. */ 35 /* return EEXIST if the same logger is registred, 0 on success. */
36 int nf_log_register(u_int8_t pf, struct nf_logger *logger) 36 int nf_log_register(u_int8_t pf, struct nf_logger *logger)
37 { 37 {
38 const struct nf_logger *llog; 38 const struct nf_logger *llog;
39 int i; 39 int i;
40 40
41 if (pf >= ARRAY_SIZE(nf_loggers)) 41 if (pf >= ARRAY_SIZE(nf_loggers))
42 return -EINVAL; 42 return -EINVAL;
43 43
44 for (i = 0; i < ARRAY_SIZE(logger->list); i++) 44 for (i = 0; i < ARRAY_SIZE(logger->list); i++)
45 INIT_LIST_HEAD(&logger->list[i]); 45 INIT_LIST_HEAD(&logger->list[i]);
46 46
47 mutex_lock(&nf_log_mutex); 47 mutex_lock(&nf_log_mutex);
48 48
49 if (pf == NFPROTO_UNSPEC) { 49 if (pf == NFPROTO_UNSPEC) {
50 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) 50 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
51 list_add_tail(&(logger->list[i]), &(nf_loggers_l[i])); 51 list_add_tail(&(logger->list[i]), &(nf_loggers_l[i]));
52 } else { 52 } else {
53 /* register at end of list to honor first register win */ 53 /* register at end of list to honor first register win */
54 list_add_tail(&logger->list[pf], &nf_loggers_l[pf]); 54 list_add_tail(&logger->list[pf], &nf_loggers_l[pf]);
55 llog = rcu_dereference_protected(nf_loggers[pf], 55 llog = rcu_dereference_protected(nf_loggers[pf],
56 lockdep_is_held(&nf_log_mutex)); 56 lockdep_is_held(&nf_log_mutex));
57 if (llog == NULL) 57 if (llog == NULL)
58 rcu_assign_pointer(nf_loggers[pf], logger); 58 rcu_assign_pointer(nf_loggers[pf], logger);
59 } 59 }
60 60
61 mutex_unlock(&nf_log_mutex); 61 mutex_unlock(&nf_log_mutex);
62 62
63 return 0; 63 return 0;
64 } 64 }
65 EXPORT_SYMBOL(nf_log_register); 65 EXPORT_SYMBOL(nf_log_register);
66 66
67 void nf_log_unregister(struct nf_logger *logger) 67 void nf_log_unregister(struct nf_logger *logger)
68 { 68 {
69 const struct nf_logger *c_logger; 69 const struct nf_logger *c_logger;
70 int i; 70 int i;
71 71
72 mutex_lock(&nf_log_mutex); 72 mutex_lock(&nf_log_mutex);
73 for (i = 0; i < ARRAY_SIZE(nf_loggers); i++) { 73 for (i = 0; i < ARRAY_SIZE(nf_loggers); i++) {
74 c_logger = rcu_dereference_protected(nf_loggers[i], 74 c_logger = rcu_dereference_protected(nf_loggers[i],
75 lockdep_is_held(&nf_log_mutex)); 75 lockdep_is_held(&nf_log_mutex));
76 if (c_logger == logger) 76 if (c_logger == logger)
77 rcu_assign_pointer(nf_loggers[i], NULL); 77 rcu_assign_pointer(nf_loggers[i], NULL);
78 list_del(&logger->list[i]); 78 list_del(&logger->list[i]);
79 } 79 }
80 mutex_unlock(&nf_log_mutex); 80 mutex_unlock(&nf_log_mutex);
81 81
82 synchronize_rcu(); 82 synchronize_rcu();
83 } 83 }
84 EXPORT_SYMBOL(nf_log_unregister); 84 EXPORT_SYMBOL(nf_log_unregister);
85 85
86 int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger) 86 int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
87 { 87 {
88 if (pf >= ARRAY_SIZE(nf_loggers))
89 return -EINVAL;
88 mutex_lock(&nf_log_mutex); 90 mutex_lock(&nf_log_mutex);
89 if (__find_logger(pf, logger->name) == NULL) { 91 if (__find_logger(pf, logger->name) == NULL) {
90 mutex_unlock(&nf_log_mutex); 92 mutex_unlock(&nf_log_mutex);
91 return -ENOENT; 93 return -ENOENT;
92 } 94 }
93 rcu_assign_pointer(nf_loggers[pf], logger); 95 rcu_assign_pointer(nf_loggers[pf], logger);
94 mutex_unlock(&nf_log_mutex); 96 mutex_unlock(&nf_log_mutex);
95 return 0; 97 return 0;
96 } 98 }
97 EXPORT_SYMBOL(nf_log_bind_pf); 99 EXPORT_SYMBOL(nf_log_bind_pf);
98 100
99 void nf_log_unbind_pf(u_int8_t pf) 101 void nf_log_unbind_pf(u_int8_t pf)
100 { 102 {
103 if (pf >= ARRAY_SIZE(nf_loggers))
104 return;
101 mutex_lock(&nf_log_mutex); 105 mutex_lock(&nf_log_mutex);
102 rcu_assign_pointer(nf_loggers[pf], NULL); 106 rcu_assign_pointer(nf_loggers[pf], NULL);
103 mutex_unlock(&nf_log_mutex); 107 mutex_unlock(&nf_log_mutex);
104 } 108 }
105 EXPORT_SYMBOL(nf_log_unbind_pf); 109 EXPORT_SYMBOL(nf_log_unbind_pf);
106 110
107 void nf_log_packet(u_int8_t pf, 111 void nf_log_packet(u_int8_t pf,
108 unsigned int hooknum, 112 unsigned int hooknum,
109 const struct sk_buff *skb, 113 const struct sk_buff *skb,
110 const struct net_device *in, 114 const struct net_device *in,
111 const struct net_device *out, 115 const struct net_device *out,
112 const struct nf_loginfo *loginfo, 116 const struct nf_loginfo *loginfo,
113 const char *fmt, ...) 117 const char *fmt, ...)
114 { 118 {
115 va_list args; 119 va_list args;
116 char prefix[NF_LOG_PREFIXLEN]; 120 char prefix[NF_LOG_PREFIXLEN];
117 const struct nf_logger *logger; 121 const struct nf_logger *logger;
118 122
119 rcu_read_lock(); 123 rcu_read_lock();
120 logger = rcu_dereference(nf_loggers[pf]); 124 logger = rcu_dereference(nf_loggers[pf]);
121 if (logger) { 125 if (logger) {
122 va_start(args, fmt); 126 va_start(args, fmt);
123 vsnprintf(prefix, sizeof(prefix), fmt, args); 127 vsnprintf(prefix, sizeof(prefix), fmt, args);
124 va_end(args); 128 va_end(args);
125 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix); 129 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
126 } 130 }
127 rcu_read_unlock(); 131 rcu_read_unlock();
128 } 132 }
129 EXPORT_SYMBOL(nf_log_packet); 133 EXPORT_SYMBOL(nf_log_packet);
130 134
131 #ifdef CONFIG_PROC_FS 135 #ifdef CONFIG_PROC_FS
132 static void *seq_start(struct seq_file *seq, loff_t *pos) 136 static void *seq_start(struct seq_file *seq, loff_t *pos)
133 { 137 {
134 mutex_lock(&nf_log_mutex); 138 mutex_lock(&nf_log_mutex);
135 139
136 if (*pos >= ARRAY_SIZE(nf_loggers)) 140 if (*pos >= ARRAY_SIZE(nf_loggers))
137 return NULL; 141 return NULL;
138 142
139 return pos; 143 return pos;
140 } 144 }
141 145
142 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 146 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
143 { 147 {
144 (*pos)++; 148 (*pos)++;
145 149
146 if (*pos >= ARRAY_SIZE(nf_loggers)) 150 if (*pos >= ARRAY_SIZE(nf_loggers))
147 return NULL; 151 return NULL;
148 152
149 return pos; 153 return pos;
150 } 154 }
151 155
152 static void seq_stop(struct seq_file *s, void *v) 156 static void seq_stop(struct seq_file *s, void *v)
153 { 157 {
154 mutex_unlock(&nf_log_mutex); 158 mutex_unlock(&nf_log_mutex);
155 } 159 }
156 160
157 static int seq_show(struct seq_file *s, void *v) 161 static int seq_show(struct seq_file *s, void *v)
158 { 162 {
159 loff_t *pos = v; 163 loff_t *pos = v;
160 const struct nf_logger *logger; 164 const struct nf_logger *logger;
161 struct nf_logger *t; 165 struct nf_logger *t;
162 int ret; 166 int ret;
163 167
164 logger = nf_loggers[*pos]; 168 logger = nf_loggers[*pos];
165 169
166 if (!logger) 170 if (!logger)
167 ret = seq_printf(s, "%2lld NONE (", *pos); 171 ret = seq_printf(s, "%2lld NONE (", *pos);
168 else 172 else
169 ret = seq_printf(s, "%2lld %s (", *pos, logger->name); 173 ret = seq_printf(s, "%2lld %s (", *pos, logger->name);
170 174
171 if (ret < 0) 175 if (ret < 0)
172 return ret; 176 return ret;
173 177
174 list_for_each_entry(t, &nf_loggers_l[*pos], list[*pos]) { 178 list_for_each_entry(t, &nf_loggers_l[*pos], list[*pos]) {
175 ret = seq_printf(s, "%s", t->name); 179 ret = seq_printf(s, "%s", t->name);
176 if (ret < 0) 180 if (ret < 0)
177 return ret; 181 return ret;
178 if (&t->list[*pos] != nf_loggers_l[*pos].prev) { 182 if (&t->list[*pos] != nf_loggers_l[*pos].prev) {
179 ret = seq_printf(s, ","); 183 ret = seq_printf(s, ",");
180 if (ret < 0) 184 if (ret < 0)
181 return ret; 185 return ret;
182 } 186 }
183 } 187 }
184 188
185 return seq_printf(s, ")\n"); 189 return seq_printf(s, ")\n");
186 } 190 }
187 191
188 static const struct seq_operations nflog_seq_ops = { 192 static const struct seq_operations nflog_seq_ops = {
189 .start = seq_start, 193 .start = seq_start,
190 .next = seq_next, 194 .next = seq_next,
191 .stop = seq_stop, 195 .stop = seq_stop,
192 .show = seq_show, 196 .show = seq_show,
193 }; 197 };
194 198
195 static int nflog_open(struct inode *inode, struct file *file) 199 static int nflog_open(struct inode *inode, struct file *file)
196 { 200 {
197 return seq_open(file, &nflog_seq_ops); 201 return seq_open(file, &nflog_seq_ops);
198 } 202 }
199 203
200 static const struct file_operations nflog_file_ops = { 204 static const struct file_operations nflog_file_ops = {
201 .owner = THIS_MODULE, 205 .owner = THIS_MODULE,
202 .open = nflog_open, 206 .open = nflog_open,
203 .read = seq_read, 207 .read = seq_read,
204 .llseek = seq_lseek, 208 .llseek = seq_lseek,
205 .release = seq_release, 209 .release = seq_release,
206 }; 210 };
207 211
208 212
209 #endif /* PROC_FS */ 213 #endif /* PROC_FS */
210 214
211 #ifdef CONFIG_SYSCTL 215 #ifdef CONFIG_SYSCTL
212 static struct ctl_path nf_log_sysctl_path[] = { 216 static struct ctl_path nf_log_sysctl_path[] = {
213 { .procname = "net", }, 217 { .procname = "net", },
214 { .procname = "netfilter", }, 218 { .procname = "netfilter", },
215 { .procname = "nf_log", }, 219 { .procname = "nf_log", },
216 { } 220 { }
217 }; 221 };
218 222
219 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3]; 223 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
220 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1]; 224 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
221 static struct ctl_table_header *nf_log_dir_header; 225 static struct ctl_table_header *nf_log_dir_header;
222 226
223 static int nf_log_proc_dostring(ctl_table *table, int write, 227 static int nf_log_proc_dostring(ctl_table *table, int write,
224 void __user *buffer, size_t *lenp, loff_t *ppos) 228 void __user *buffer, size_t *lenp, loff_t *ppos)
225 { 229 {
226 const struct nf_logger *logger; 230 const struct nf_logger *logger;
227 char buf[NFLOGGER_NAME_LEN]; 231 char buf[NFLOGGER_NAME_LEN];
228 size_t size = *lenp; 232 size_t size = *lenp;
229 int r = 0; 233 int r = 0;
230 int tindex = (unsigned long)table->extra1; 234 int tindex = (unsigned long)table->extra1;
231 235
232 if (write) { 236 if (write) {
233 if (size > sizeof(buf)) 237 if (size > sizeof(buf))
234 size = sizeof(buf); 238 size = sizeof(buf);
235 if (copy_from_user(buf, buffer, size)) 239 if (copy_from_user(buf, buffer, size))
236 return -EFAULT; 240 return -EFAULT;
237 241
238 if (!strcmp(buf, "NONE")) { 242 if (!strcmp(buf, "NONE")) {
239 nf_log_unbind_pf(tindex); 243 nf_log_unbind_pf(tindex);
240 return 0; 244 return 0;
241 } 245 }
242 mutex_lock(&nf_log_mutex); 246 mutex_lock(&nf_log_mutex);
243 logger = __find_logger(tindex, buf); 247 logger = __find_logger(tindex, buf);
244 if (logger == NULL) { 248 if (logger == NULL) {
245 mutex_unlock(&nf_log_mutex); 249 mutex_unlock(&nf_log_mutex);
246 return -ENOENT; 250 return -ENOENT;
247 } 251 }
248 rcu_assign_pointer(nf_loggers[tindex], logger); 252 rcu_assign_pointer(nf_loggers[tindex], logger);
249 mutex_unlock(&nf_log_mutex); 253 mutex_unlock(&nf_log_mutex);
250 } else { 254 } else {
251 mutex_lock(&nf_log_mutex); 255 mutex_lock(&nf_log_mutex);
252 logger = nf_loggers[tindex]; 256 logger = nf_loggers[tindex];
253 if (!logger) 257 if (!logger)
254 table->data = "NONE"; 258 table->data = "NONE";
255 else 259 else
256 table->data = logger->name; 260 table->data = logger->name;
257 r = proc_dostring(table, write, buffer, lenp, ppos); 261 r = proc_dostring(table, write, buffer, lenp, ppos);
258 mutex_unlock(&nf_log_mutex); 262 mutex_unlock(&nf_log_mutex);
259 } 263 }
260 264
261 return r; 265 return r;
262 } 266 }
263 267
264 static __init int netfilter_log_sysctl_init(void) 268 static __init int netfilter_log_sysctl_init(void)
265 { 269 {
266 int i; 270 int i;
267 271
268 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { 272 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
269 snprintf(nf_log_sysctl_fnames[i-NFPROTO_UNSPEC], 3, "%d", i); 273 snprintf(nf_log_sysctl_fnames[i-NFPROTO_UNSPEC], 3, "%d", i);
270 nf_log_sysctl_table[i].procname = 274 nf_log_sysctl_table[i].procname =
271 nf_log_sysctl_fnames[i-NFPROTO_UNSPEC]; 275 nf_log_sysctl_fnames[i-NFPROTO_UNSPEC];
272 nf_log_sysctl_table[i].data = NULL; 276 nf_log_sysctl_table[i].data = NULL;
273 nf_log_sysctl_table[i].maxlen = 277 nf_log_sysctl_table[i].maxlen =
274 NFLOGGER_NAME_LEN * sizeof(char); 278 NFLOGGER_NAME_LEN * sizeof(char);
275 nf_log_sysctl_table[i].mode = 0644; 279 nf_log_sysctl_table[i].mode = 0644;
276 nf_log_sysctl_table[i].proc_handler = nf_log_proc_dostring; 280 nf_log_sysctl_table[i].proc_handler = nf_log_proc_dostring;
277 nf_log_sysctl_table[i].extra1 = (void *)(unsigned long) i; 281 nf_log_sysctl_table[i].extra1 = (void *)(unsigned long) i;
278 } 282 }
279 283
280 nf_log_dir_header = register_sysctl_paths(nf_log_sysctl_path, 284 nf_log_dir_header = register_sysctl_paths(nf_log_sysctl_path,
281 nf_log_sysctl_table); 285 nf_log_sysctl_table);
282 if (!nf_log_dir_header) 286 if (!nf_log_dir_header)
283 return -ENOMEM; 287 return -ENOMEM;
284 288
285 return 0; 289 return 0;
286 } 290 }
287 #else 291 #else
288 static __init int netfilter_log_sysctl_init(void) 292 static __init int netfilter_log_sysctl_init(void)
289 { 293 {
290 return 0; 294 return 0;
291 } 295 }
292 #endif /* CONFIG_SYSCTL */ 296 #endif /* CONFIG_SYSCTL */
293 297
294 int __init netfilter_log_init(void) 298 int __init netfilter_log_init(void)
295 { 299 {
296 int i, r; 300 int i, r;
297 #ifdef CONFIG_PROC_FS 301 #ifdef CONFIG_PROC_FS
298 if (!proc_create("nf_log", S_IRUGO, 302 if (!proc_create("nf_log", S_IRUGO,
299 proc_net_netfilter, &nflog_file_ops)) 303 proc_net_netfilter, &nflog_file_ops))
300 return -1; 304 return -1;
301 #endif 305 #endif
302 306
303 /* Errors will trigger panic, unroll on error is unnecessary. */ 307 /* Errors will trigger panic, unroll on error is unnecessary. */
304 r = netfilter_log_sysctl_init(); 308 r = netfilter_log_sysctl_init();
305 if (r < 0) 309 if (r < 0)
306 return r; 310 return r;
307 311
308 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) 312 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
309 INIT_LIST_HEAD(&(nf_loggers_l[i])); 313 INIT_LIST_HEAD(&(nf_loggers_l[i]));
310 314
311 return 0; 315 return 0;
312 } 316 }
313 317