From 88582bb094a052eaa0979d339b08ef420ef85e10 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= Date: Mon, 22 May 2017 09:59:35 +0200 Subject: [PATCH] add fix for DoS via nftables --- ...t_rbtree-handle-re-addition-element-.patch | 54 +++++++++++++++++++ Makefile | 1 + 2 files changed, 55 insertions(+) create mode 100644 0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch diff --git a/0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch b/0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch new file mode 100644 index 0000000..edf749f --- /dev/null +++ b/0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch @@ -0,0 +1,54 @@ +From 6fa9fc0ce1032710ce017c444b0c66eaf9e77782 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Mon, 22 May 2017 00:17:30 +0200 +Subject: [PATCH linux] netfilter: nft_set_rbtree: handle re-addition element + after deletion + +The existing code selects no next branch to be inspected when +re-inserting an inactive element into the rb-tree, looping endlessly. +This patch restricts the check for active elements to the EEXIST case +only. + +Fixes: e701001e7cbe ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates") +Reported-by: Wolfgang Bumiller +Signed-off-by: Pablo Neira Ayuso +--- + net/netfilter/nft_set_rbtree.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index f06f55e..51ff879 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -118,17 +118,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, + else if (d > 0) + p = &parent->rb_right; + else { +- if (nft_set_elem_active(&rbe->ext, genmask)) { +- if (nft_rbtree_interval_end(rbe) && +- !nft_rbtree_interval_end(new)) +- p = &parent->rb_left; +- else if (!nft_rbtree_interval_end(rbe) && +- nft_rbtree_interval_end(new)) +- p = &parent->rb_right; +- else { +- *ext = &rbe->ext; +- return -EEXIST; +- } ++ if (nft_rbtree_interval_end(rbe) && ++ !nft_rbtree_interval_end(new)) { ++ p = &parent->rb_left; ++ } else if (!nft_rbtree_interval_end(rbe) && ++ nft_rbtree_interval_end(new)) { ++ p = &parent->rb_right; ++ } else if (nft_set_elem_active(&rbe->ext, genmask)) { ++ *ext = &rbe->ext; ++ return -EEXIST; ++ } else { ++ p = &parent->rb_left; + } + } + } +-- +2.1.4 + diff --git a/Makefile b/Makefile index 45d9e3b..d105256 100644 --- a/Makefile +++ b/Makefile @@ -240,6 +240,7 @@ ${KERNEL_SRC}/README ${KERNEL_CFG_ORG}: ${KERNEL_SRC_SUBMODULE} | submodules cd ${KERNEL_SRC}; patch -p1 < ../swapops-0002-Revert-mm-ksm-convert-write_protect_page-to-use-page.patch cd ${KERNEL_SRC}; patch -p1 < ../swapops-0003-Revert-mm-introduce-page_vma_mapped_walk.patch cd ${KERNEL_SRC}; patch -p1 < ../swapops-0004-mm-ksm-handle-protnone-saved-writes-when-making-page.patch + cd ${KERNEL_SRC}; patch -p1 < ../0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch # DoS from within (unpriv) containers sed -i ${KERNEL_SRC}/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=${EXTRAVERSION}/' touch $@