Skip to content

Commit 8cdb46d

Browse files
HSchillummakynes
HSchill
authored and
ummakynes
committed
netfilter: log: netns NULL ptr bug when calling from conntrack
Since (69b34fb netfilter: xt_LOG: add net namespace support for xt_LOG), we hit this: [ 4224.708977] BUG: unable to handle kernel NULL pointer dereference at 0000000000000388 [ 4224.709074] IP: [<ffffffff8147f699>] ipt_log_packet+0x29/0x270 when callling log functions from conntrack both in and out are NULL i.e. the net pointer is invalid. Adding struct net *net in call to nf_logfn() will secure that there always is a vaild net ptr. Reported as netfilter's bugzilla bug 818: https://bugzilla.netfilter.org/show_bug.cgi?id=818 Reported-by: Ronald <ronald645@gmail.com> Signed-off-by: Hans Schillstrom <hans@schillstrom.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
1 parent 42010ed commit 8cdb46d

File tree

9 files changed

+40
-30
lines changed

9 files changed

+40
-30
lines changed

‎include/net/netfilter/nf_log.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ struct nf_loginfo {
3030
} u;
3131
};
3232

33-
typedef void nf_logfn(u_int8_t pf,
33+
typedef void nf_logfn(struct net *net,
34+
u_int8_t pf,
3435
unsigned int hooknum,
3536
const struct sk_buff *skb,
3637
const struct net_device *in,

‎include/net/netfilter/nfnetlink_log.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
#define _KER_NFNETLINK_LOG_H
33

44
void
5-
nfulnl_log_packet(u_int8_t pf,
5+
nfulnl_log_packet(struct net *net,
6+
u_int8_t pf,
67
unsigned int hooknum,
78
const struct sk_buff *skb,
89
const struct net_device *in,

‎net/bridge/netfilter/ebt_log.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -72,13 +72,12 @@ print_ports(const struct sk_buff *skb, uint8_t protocol, int offset)
7272
}
7373

7474
static void
75-
ebt_log_packet(u_int8_t pf, unsigned int hooknum,
76-
const struct sk_buff *skb, const struct net_device *in,
77-
const struct net_device *out, const struct nf_loginfo *loginfo,
78-
const char *prefix)
75+
ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
76+
const struct sk_buff *skb, const struct net_device *in,
77+
const struct net_device *out, const struct nf_loginfo *loginfo,
78+
const char *prefix)
7979
{
8080
unsigned int bitmask;
81-
struct net *net = dev_net(in ? in : out);
8281

8382
/* FIXME: Disabled from containers until syslog ns is supported */
8483
if (!net_eq(net, &init_net))
@@ -191,7 +190,7 @@ ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par)
191190
nf_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb,
192191
par->in, par->out, &li, "%s", info->prefix);
193192
else
194-
ebt_log_packet(NFPROTO_BRIDGE, par->hooknum, skb, par->in,
193+
ebt_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, par->in,
195194
par->out, &li, info->prefix);
196195
return EBT_CONTINUE;
197196
}

‎net/bridge/netfilter/ebt_ulog.c

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -131,14 +131,16 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
131131
return skb;
132132
}
133133

134-
static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
135-
const struct net_device *in, const struct net_device *out,
136-
const struct ebt_ulog_info *uloginfo, const char *prefix)
134+
static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
135+
const struct sk_buff *skb,
136+
const struct net_device *in,
137+
const struct net_device *out,
138+
const struct ebt_ulog_info *uloginfo,
139+
const char *prefix)
137140
{
138141
ebt_ulog_packet_msg_t *pm;
139142
size_t size, copy_len;
140143
struct nlmsghdr *nlh;
141-
struct net *net = dev_net(in ? in : out);
142144
struct ebt_ulog_net *ebt = ebt_ulog_pernet(net);
143145
unsigned int group = uloginfo->nlgroup;
144146
ebt_ulog_buff_t *ub = &ebt->ulog_buffers[group];
@@ -233,7 +235,7 @@ static void ebt_ulog_packet(unsigned int hooknr, const struct sk_buff *skb,
233235
}
234236

235237
/* this function is registered with the netfilter core */
236-
static void ebt_log_packet(u_int8_t pf, unsigned int hooknum,
238+
static void ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
237239
const struct sk_buff *skb, const struct net_device *in,
238240
const struct net_device *out, const struct nf_loginfo *li,
239241
const char *prefix)
@@ -252,13 +254,15 @@ static void ebt_log_packet(u_int8_t pf, unsigned int hooknum,
252254
strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
253255
}
254256

255-
ebt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
257+
ebt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
256258
}
257259

258260
static unsigned int
259261
ebt_ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
260262
{
261-
ebt_ulog_packet(par->hooknum, skb, par->in, par->out,
263+
struct net *net = dev_net(par->in ? par->in : par->out);
264+
265+
ebt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
262266
par->targinfo, NULL);
263267
return EBT_CONTINUE;
264268
}

‎net/ipv4/netfilter/ipt_ULOG.c

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,8 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
162162
return skb;
163163
}
164164

165-
static void ipt_ulog_packet(unsigned int hooknum,
165+
static void ipt_ulog_packet(struct net *net,
166+
unsigned int hooknum,
166167
const struct sk_buff *skb,
167168
const struct net_device *in,
168169
const struct net_device *out,
@@ -174,7 +175,6 @@ static void ipt_ulog_packet(unsigned int hooknum,
174175
size_t size, copy_len;
175176
struct nlmsghdr *nlh;
176177
struct timeval tv;
177-
struct net *net = dev_net(in ? in : out);
178178
struct ulog_net *ulog = ulog_pernet(net);
179179

180180
/* ffs == find first bit set, necessary because userspace
@@ -291,12 +291,15 @@ static void ipt_ulog_packet(unsigned int hooknum,
291291
static unsigned int
292292
ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
293293
{
294-
ipt_ulog_packet(par->hooknum, skb, par->in, par->out,
294+
struct net *net = dev_net(par->in ? par->in : par->out);
295+
296+
ipt_ulog_packet(net, par->hooknum, skb, par->in, par->out,
295297
par->targinfo, NULL);
296298
return XT_CONTINUE;
297299
}
298300

299-
static void ipt_logfn(u_int8_t pf,
301+
static void ipt_logfn(struct net *net,
302+
u_int8_t pf,
300303
unsigned int hooknum,
301304
const struct sk_buff *skb,
302305
const struct net_device *in,
@@ -318,7 +321,7 @@ static void ipt_logfn(u_int8_t pf,
318321
strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
319322
}
320323

321-
ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
324+
ipt_ulog_packet(net, hooknum, skb, in, out, &loginfo, prefix);
322325
}
323326

324327
static int ulog_tg_check(const struct xt_tgchk_param *par)

‎net/netfilter/nf_log.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ void nf_log_packet(struct net *net,
148148
va_start(args, fmt);
149149
vsnprintf(prefix, sizeof(prefix), fmt, args);
150150
va_end(args);
151-
logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
151+
logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
152152
}
153153
rcu_read_unlock();
154154
}

‎net/netfilter/nfnetlink_log.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -602,7 +602,8 @@ static struct nf_loginfo default_loginfo = {
602602

603603
/* log handler for internal netfilter logging api */
604604
void
605-
nfulnl_log_packet(u_int8_t pf,
605+
nfulnl_log_packet(struct net *net,
606+
u_int8_t pf,
606607
unsigned int hooknum,
607608
const struct sk_buff *skb,
608609
const struct net_device *in,
@@ -615,7 +616,6 @@ nfulnl_log_packet(u_int8_t pf,
615616
const struct nf_loginfo *li;
616617
unsigned int qthreshold;
617618
unsigned int plen;
618-
struct net *net = dev_net(in ? in : out);
619619
struct nfnl_log_net *log = nfnl_log_pernet(net);
620620

621621
if (li_user && li_user->type == NF_LOG_TYPE_ULOG)

‎net/netfilter/xt_LOG.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -466,7 +466,8 @@ log_packet_common(struct sbuff *m,
466466

467467

468468
static void
469-
ipt_log_packet(u_int8_t pf,
469+
ipt_log_packet(struct net *net,
470+
u_int8_t pf,
470471
unsigned int hooknum,
471472
const struct sk_buff *skb,
472473
const struct net_device *in,
@@ -475,7 +476,6 @@ ipt_log_packet(u_int8_t pf,
475476
const char *prefix)
476477
{
477478
struct sbuff *m;
478-
struct net *net = dev_net(in ? in : out);
479479

480480
/* FIXME: Disabled from containers until syslog ns is supported */
481481
if (!net_eq(net, &init_net))
@@ -797,7 +797,8 @@ static void dump_ipv6_mac_header(struct sbuff *m,
797797
}
798798

799799
static void
800-
ip6t_log_packet(u_int8_t pf,
800+
ip6t_log_packet(struct net *net,
801+
u_int8_t pf,
801802
unsigned int hooknum,
802803
const struct sk_buff *skb,
803804
const struct net_device *in,
@@ -806,7 +807,6 @@ ip6t_log_packet(u_int8_t pf,
806807
const char *prefix)
807808
{
808809
struct sbuff *m;
809-
struct net *net = dev_net(in ? in : out);
810810

811811
/* FIXME: Disabled from containers until syslog ns is supported */
812812
if (!net_eq(net, &init_net))
@@ -833,17 +833,18 @@ log_tg(struct sk_buff *skb, const struct xt_action_param *par)
833833
{
834834
const struct xt_log_info *loginfo = par->targinfo;
835835
struct nf_loginfo li;
836+
struct net *net = dev_net(par->in ? par->in : par->out);
836837

837838
li.type = NF_LOG_TYPE_LOG;
838839
li.u.log.level = loginfo->level;
839840
li.u.log.logflags = loginfo->logflags;
840841

841842
if (par->family == NFPROTO_IPV4)
842-
ipt_log_packet(NFPROTO_IPV4, par->hooknum, skb, par->in,
843+
ipt_log_packet(net, NFPROTO_IPV4, par->hooknum, skb, par->in,
843844
par->out, &li, loginfo->prefix);
844845
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
845846
else if (par->family == NFPROTO_IPV6)
846-
ip6t_log_packet(NFPROTO_IPV6, par->hooknum, skb, par->in,
847+
ip6t_log_packet(net, NFPROTO_IPV6, par->hooknum, skb, par->in,
847848
par->out, &li, loginfo->prefix);
848849
#endif
849850
else

‎net/netfilter/xt_NFLOG.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,14 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
2626
{
2727
const struct xt_nflog_info *info = par->targinfo;
2828
struct nf_loginfo li;
29+
struct net *net = dev_net(par->in ? par->in : par->out);
2930

3031
li.type = NF_LOG_TYPE_ULOG;
3132
li.u.ulog.copy_len = info->len;
3233
li.u.ulog.group = info->group;
3334
li.u.ulog.qthreshold = info->threshold;
3435

35-
nfulnl_log_packet(par->family, par->hooknum, skb, par->in,
36+
nfulnl_log_packet(net, par->family, par->hooknum, skb, par->in,
3637
par->out, &li, info->prefix);
3738
return XT_CONTINUE;
3839
}

0 commit comments

Comments
 (0)