[lkml]   [2019]   [Dec]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH nf] netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
On Thu, Dec 26, 2019 at 4:37 PM Florian Westphal <> wrote:
> We get crash when the targets checkentry function tries to make
> use of the network namespace pointer for arptables.
> When the net pointer got added back in 2010, only ip/ip6/ebtables were
> changed to initialize it, so arptables has this set to NULL.
> This isn't a problem for normal arptables because no existing
> arptables target has a checkentry function that makes use of par->net.
> However, direct users of the setsockopt interface can provide any
> target they want as long as its registered for ARP or UNPSEC protocols.
> syzkaller managed to send a semi-valid arptables rule for RATEEST target
> which is enough to trigger NULL deref:
> kasan: GPF could be caused by NULL-ptr deref or user memory access
> general protection fault: 0000 [#1] PREEMPT SMP KASAN
> RIP: xt_rateest_tg_checkentry+0x11d/0xb40 net/netfilter/xt_RATEEST.c:109
> [..]
> xt_check_target+0x283/0x690 net/netfilter/x_tables.c:1019
> check_target net/ipv4/netfilter/arp_tables.c:399 [inline]
> find_check_entry net/ipv4/netfilter/arp_tables.c:422 [inline]
> translate_table+0x1005/0x1d70 net/ipv4/netfilter/arp_tables.c:572
> do_replace net/ipv4/netfilter/arp_tables.c:977 [inline]
> do_arpt_set_ctl+0x310/0x640 net/ipv4/netfilter/arp_tables.c:1456
> Fixes: add67461240c1d ("netfilter: add struct net * to target parameters")
> Reported-by:
> Signed-off-by: Florian Westphal <>

I was about to send out a same patch.

Acked-by: Cong Wang <>


 \ /
  Last update: 2019-12-27 05:19    [W:0.048 / U:0.864 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site