[RHEL8,COMMIT] ms/netfilter: nf_tables: use-after-free in dynamic operations

Submitted by Konstantin Khorenko on March 31, 2020, 9:53 a.m.

Details

Message ID 202003310953.02V9rkBA001088@finist_co8.work.ct
State New
Series "ms/netfilter: nf_tables: use-after-free in dynamic operations"
Headers show

Commit Message

Konstantin Khorenko March 31, 2020, 9:53 a.m.
The commit is pushed to "branch-rh8-4.18.0-80.1.2.vz8.3.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-80.1.2.vz8.3.4
------>
commit 51724d38bd5fb7f557356da8111c8c69e458a6db
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Mar 11 13:04:16 2019 +0100

    ms/netfilter: nf_tables: use-after-free in dynamic operations
    
    Smatch reports:
    
           net/netfilter/nf_tables_api.c:2167 nf_tables_expr_destroy()
            error: dereferencing freed memory 'expr->ops'
    
    net/netfilter/nf_tables_api.c
        2162 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
        2163                                   struct nft_expr *expr)
        2164 {
        2165        if (expr->ops->destroy)
        2166                expr->ops->destroy(ctx, expr);
                                                    ^^^^
    --> 2167        module_put(expr->ops->type->owner);
                               ^^^^^^^^^
        2168 }
    
    Smatch says there are three functions which free expr->ops.
    
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    
    (cherry picked from commit 3f3a390dbd59d236f62cff8e8b20355ef7069e3d)
    Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
---
 net/netfilter/nf_tables_api.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Patch hide | download patch | download mbox

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ab5b899958ae..2236835b9c2e 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2085,9 +2085,11 @@  static int nf_tables_newexpr(const struct nft_ctx *ctx,
 static void nf_tables_expr_destroy(const struct nft_ctx *ctx,
 				   struct nft_expr *expr)
 {
+	const struct nft_expr_type *type = expr->ops->type;
+
 	if (expr->ops->destroy)
 		expr->ops->destroy(ctx, expr);
-	module_put(expr->ops->type->owner);
+	module_put(type->owner);
 }
 
 struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,