index 55802e97f906d1987ed78b4296584deb38e5f876..8516dc459b539342f44d2b2b3e21b140677c7826 100644
@@ -210,6 +210,9 @@ xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision)
 {
 	struct xt_match *match;
 
+	if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
+		return ERR_PTR(-EINVAL);
+
 	match = xt_find_match(nfproto, name, revision);
 	if (IS_ERR(match)) {
 		request_module("%st_%s", xt_prefix[nfproto], name);

Florian Westphal

maintainer

2018-01-24 23:19 UTC #1 lore raw

Quoted 3 lines · Eric Dumazet

From: Eric Dumazet <[email protected]>
It looks like syzbot found its way into netfilter territory.

Excellent. This will sure allow to find and fix more bugs :-)

Quoted 2 lines

Issue here is that @name comes from user space and might not be null terminated.

Indeed, thanks for fixing this Eric.

xt_find_target() and xt_find_table_lock() might have similar issues.

Pablo Neira Ayuso

maintainer

2018-01-24 23:50 UTC #2 lore raw

Quoted 5 lines · Florian Westphal

Quoted 3 lines · Eric Dumazet
From: Eric Dumazet <[email protected]>
It looks like syzbot found its way into netfilter territory.

Quoted 8 lines

Excellent. This will sure allow to find and fix more bugs :-)
Quoted 2 lines
Issue here is that @name comes from user space and might not be null terminated.
Indeed, thanks for fixing this Eric.
xt_find_target() and xt_find_table_lock() might have similar issues.

I'm going to keep back this patch then, it would be good if we can find this in one single patch.

Thanks.

Pablo Neira Ayuso

maintainer

2018-01-25 00:13 UTC #3 lore raw

Quoted 11 lines · Pablo Neira Ayuso

Quoted 10 lines · Florian Westphal
Quoted 3 lines · Eric Dumazet
From: Eric Dumazet <[email protected]>
It looks like syzbot found its way into netfilter territory.
Excellent. This will sure allow to find and fix more bugs :-)
Quoted 2 lines
Issue here is that @name comes from user space and might not be null terminated.

Quoted 6 lines

Quoted 3 lines
Indeed, thanks for fixing this Eric.
xt_find_target() and xt_find_table_lock() might have similar issues.
I'm going to keep back this patch then, it would be good if we can find this in one single patch.

s/find/fix/

Sorry.

Eric Dumazet

author

2018-01-25 01:13 UTC #4 lore raw

Quoted 14 lines · Pablo Neira Ayuso

Quoted 13 lines · Pablo Neira Ayuso
Quoted 12 lines · Florian Westphal
Quoted 3 lines · Eric Dumazet
From: Eric Dumazet <[email protected]>
It looks like syzbot found its way into netfilter territory.
Excellent. This will sure allow to find and fix more bugs :-)
Quoted 2 lines
Issue here is that @name comes from user space and might not be null terminated.
Indeed, thanks for fixing this Eric.

Quoted 8 lines

Quoted 4 lines
Quoted 1 line
xt_find_target() and xt_find_table_lock() might have similar issues.
I'm going to keep back this patch then, it would be good if we can find this in one single patch.
s/find/fix/
Sorry.

Ok, but apparently you partially fixed this recently :/

Commits 78b79876761b8 and b301f25387599 took care of xt_find_table_lock() it seems.

I'll send a V2 including xt_request_find_target()

Eric Dumazet

author

2018-01-25 01:16 UTC #5 lore raw

PATCH v2 1/1 netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}

In reply to Pablo Neira Ayuso

From: Eric Dumazet <[email protected]>

It looks like syzbot found its way into netfilter territory.

Issue here is that @name comes from user space and might not be null terminated.

Out-of-bound reads happen, KASAN is not happy.

v2 added similar fix for xt_request_find_target(), as Florian advised.

Signed-off-by Eric Dumazet <[email protected]>

Reported-by syzbot <[email protected]>

---
No Fixes: tag, bug seems to be a day-0 one.

net/netfilter/x_tables.c | 6 ++++++

 1 file changed, 6 insertions(+)

net/netfilter/x_tables.c +6 -0

index 55802e97f906d1987ed78b4296584deb38e5f876..ecffc51ce83b07c063a0db67cdb33d9bf48a75ac 100644
@@ -210,6 +210,9 @@ xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision)
 {
 	struct xt_match *match;
 
+	if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
+		return ERR_PTR(-EINVAL);
+
 	match = xt_find_match(nfproto, name, revision);
 	if (IS_ERR(match)) {
 		request_module("%st_%s", xt_prefix[nfproto], name);

@@ -252,6 +255,9 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
 {
 	struct xt_target *target;
 
+	if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
+		return ERR_PTR(-EINVAL);
+
 	target = xt_find_target(af, name, revision);
 	if (IS_ERR(target)) {
 		request_module("%st_%s", xt_prefix[af], name);

Florian Westphal

maintainer Acked-by on v2 1/1

2018-01-25 06:09 UTC #6 lore raw

Re: [PATCH v2 net] netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}

Quoted 7 lines · Eric Dumazet

From: Eric Dumazet <[email protected]>
It looks like syzbot found its way into netfilter territory.
Issue here is that @name comes from user space and might not be null terminated.

Quoted 7 lines

Out-of-bound reads happen, KASAN is not happy.
v2 added similar fix for xt_request_find_target(), as Florian advised.
Signed-off-by Eric Dumazet <[email protected]>
Reported-by syzbot <[email protected]>

Thanks a lot Eric!

Acked-by Florian Westphal <[email protected]>

Pablo Neira Ayuso

maintainer Applied

2018-01-25 11:33 UTC #7 lore raw

Re: [PATCH v2 net] netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}

In reply to Eric Dumazet

Quoted 11 lines · Eric Dumazet

From: Eric Dumazet <[email protected]>
It looks like syzbot found its way into netfilter territory.
Issue here is that @name comes from user space and might not be null terminated.
Out-of-bound reads happen, KASAN is not happy.
v2 added similar fix for xt_request_find_target(), as Florian advised.

Applied, thanks Eric.

Pablo Neira Ayuso

maintainer Applied

2018-01-24 23:49 UTC #8 lore raw

In reply to Eric Dumazet

Quoted 8 lines · Eric Dumazet

From: Eric Dumazet <[email protected]>
It looks like syzbot found its way into netfilter territory.
Issue here is that @name comes from user space and might not be null terminated.
Out-of-bound reads happen, KASAN is not happy.

Applied, thanks Eric.