Commit aeed55a0 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit 



syzbot reports:
BUG: KASAN: slab-out-of-bounds in __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42
[..]
 list_del include/linux/list.h:148 [inline]
 cttimeout_net_exit+0x211/0x540 net/netfilter/nfnetlink_cttimeout.c:617

No reproducer so far. Looking at recent changes in this area
its clear that the free_head must not be at the end of the
structure because nf_ct_timeout structure has variable size.

Reported-by: default avatar <syzbot+92968395eedbdbd3617d@syzkaller.appspotmail.com>
Fixes: 78222bac ("netfilter: cttimeout: decouple unlink and free on netns destruction")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 56b14ece

net/netfilter/nfnetlink_cttimeout.c

+3 −2
Original line number Diff line number Diff line
@@ -35,12 +35,13 @@ static unsigned int nfct_timeout_id __read_mostly; 


struct ctnl_timeout {

	struct list_head	head;

	struct list_head	free_head;

	struct rcu_head		rcu_head;

	refcount_t		refcnt;

	char			name[CTNL_TIMEOUT_NAME_MAX];

	struct nf_ct_timeout	timeout;



	struct list_head	free_head;

	/* must be at the end */

	struct nf_ct_timeout	timeout;

};



struct nfct_timeout_pernet {