netfilter: cttimeout: remove VLA usage

PATCH Applied Gustavo A. R. Silva 3 participants 5 messages Mar 12, 2018 – Mar 20, 2018

Subsystems (3)

Networking Network drivers netfilter

lore

Share & tools

lore

Gustavo A. R. Silva

author

2018-03-12 23:14 UTC #0 lore raw

PATCH 1/1 netfilter: cttimeout: remove VLA usage

In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation.

Quoted 1 line

From a security viewpoint, the use of Variable Length Arrays can be

a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug.

Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
 net/netfilter/nfnetlink_cttimeout.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

net/netfilter/nfnetlink_cttimeout.c +17 -9

index 6819300..dcd7bd3 100644
@@ -51,19 +51,27 @@ ctnl_timeout_parse_policy(void *timeouts,
 			  const struct nf_conntrack_l4proto *l4proto,
 			  struct net *net, const struct nlattr *attr)
 {
+	struct nlattr **tb;
 	int ret = 0;
 
-	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
-		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
+	if (!l4proto->ctnl_timeout.nlattr_to_obj)
+		return 0;
 
-		ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
-				       attr, l4proto->ctnl_timeout.nla_policy,
-				       NULL);
-		if (ret < 0)
-			return ret;
+	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
+		     GFP_KERNEL);
 
-		ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
-	}
+	if (!tb)
+		return -ENOMEM;
+
+	ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max, attr,
+			       l4proto->ctnl_timeout.nla_policy, NULL);
+	if (ret < 0)
+		goto err;
+
+	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
+
+err:
+	kfree(tb);
 	return ret;
 }

Signature · 1 line

2.7.4

Joe Perches

2018-03-12 23:58 UTC #1 lore raw

Quoted 9 lines · Gustavo A. R. Silva

In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation.
From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug.
Also, fixed as part of the directive to remove all VLAs from

[]

net/netfilter/nfnetlink_cttimeout.c

Quoted 1 line

net/netfilter/nfnetlink_cttimeout.c +0 -0

[]

net/netfilter/nfnetlink_cttimeout.c ctnl_timeout_parse_policy(void *timeouts, · line 58

Quoted 11 lines

net/netfilter/nfnetlink_cttimeout.c +3 -2

@@ -51,19 +51,27 @@ ctnl_timeout_parse_policy(void *timeouts,
 			  const struct nf_conntrack_l4proto *l4proto,
 			  struct net *net, const struct nlattr *attr)
 {
+	struct nlattr **tb;
 	int ret = 0;
 
-	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
-		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
+	if (!l4proto->ctnl_timeout.nlattr_to_obj)
+		return 0;

Why not

	if unlikely(!...)

net/netfilter/nfnetlink_cttimeout.c ctnl_timeout_parse_policy(void *timeouts, · line 61

Quoted 8 lines

net/netfilter/nfnetlink_cttimeout.c +2 -5

-		ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,
-				       attr, l4proto->ctnl_timeout.nla_policy,
-				       NULL);
-		if (ret < 0)
-			return ret;
+	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),
+		     GFP_KERNEL);

kmalloc_array?

Quoted 18 lines

net/netfilter/nfnetlink_cttimeout.c +12 -2

-		ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
-	}
+	if (!tb)
+		return -ENOMEM;
+
+	ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max, attr,
+			       l4proto->ctnl_timeout.nla_policy, NULL);
+	if (ret < 0)
+		goto err;
+
+	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);
+
+err:
+	kfree(tb);
 	return ret;
 }

Pablo Neira Ayuso

maintainer

2018-03-13 14:59 UTC #2 lore raw

Quoted 20 lines · Joe Perches

Quoted 9 lines · Gustavo A. R. Silva
In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation.
From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug.
Also, fixed as part of the directive to remove all VLAs from
[]
net/netfilter/nfnetlink_cttimeout.c
Quoted 1 line
net/netfilter/nfnetlink_cttimeout.c +0 -0
[]
Quoted 7 lines
net/netfilter/nfnetlink_cttimeout.c +1 -0
@@ -51,19 +51,27 @@ ctnl_timeout_parse_policy(void *timeouts,
 			  const struct nf_conntrack_l4proto *l4proto,
 			  struct net *net, const struct nlattr *attr)
 {
+	struct nlattr **tb;
 	int ret = 0;
 

Quoted 7 lines

net/netfilter/nfnetlink_cttimeout.c ctnl_timeout_parse_policy(void *timeouts, · line 58
Quoted 4 lines
net/netfilter/nfnetlink_cttimeout.c +2 -2
-	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
-		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
+	if (!l4proto->ctnl_timeout.nlattr_to_obj)
+		return 0;
Why not
	if unlikely(!...)

This is control plane code - not packet path - I think we should just let the compiler decide on this one, not really need to provide an explicit hint here.

Joe Perches

2018-03-13 16:13 UTC #3 lore raw

Quoted 31 lines · Pablo Neira Ayuso

Quoted 22 lines · Joe Perches
Quoted 9 lines · Gustavo A. R. Silva
In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation.
From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug.
Also, fixed as part of the directive to remove all VLAs from
[]
net/netfilter/nfnetlink_cttimeout.c
Quoted 1 line
net/netfilter/nfnetlink_cttimeout.c +0 -0
[]
Quoted 7 lines
net/netfilter/nfnetlink_cttimeout.c +1 -0
@@ -51,19 +51,27 @@ ctnl_timeout_parse_policy(void *timeouts,
 			  const struct nf_conntrack_l4proto *l4proto,
 			  struct net *net, const struct nlattr *attr)
 {
+	struct nlattr **tb;
 	int ret = 0;
 
Quoted 7 lines
net/netfilter/nfnetlink_cttimeout.c ctnl_timeout_parse_policy(void *timeouts, · line 58
Quoted 4 lines
net/netfilter/nfnetlink_cttimeout.c +2 -2
-	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {
-		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];
+	if (!l4proto->ctnl_timeout.nlattr_to_obj)
+		return 0;
Why not
	if unlikely(!...)

Quoted 3 lines

This is control plane code - not packet path - I think we should just let the compiler decide on this one, not really need to provide an explicit hint here.

I don't have an issue with that, but it should probably be mentioned in the changelog as it's unrelated to VLA removal.

Pablo Neira Ayuso

maintainer Applied

2018-03-20 12:36 UTC #4 lore raw

In reply to Gustavo A. R. Silva

Quoted 10 lines · Gustavo A. R. Silva

In preparation to enabling -Wvla, remove VLA and replace it with dynamic memory allocation.
From a security viewpoint, the use of Variable Length Arrays can be a vector for stack overflow attacks. Also, in general, as the code evolves it is easy to lose track of how big a VLA can get. Thus, we can end up having segfaults that are hard to debug.
Also, fixed as part of the directive to remove all VLAs from the kernel: https://lkml.org/lkml/2018/3/7/621

Applied, thanks.