Taehee Yoo
26b2f55252
netfilter: nf_tables: fix jumpstack depth validation
The level of struct nft_ctx is updated by nf_tables_check_loops(). That
is used to validate jumpstack depth. But jumpstack validation routine
doesn't update and validate recursively. So, in some cases, chain depth
can be bigger than the NFT_JUMP_STACK_SIZE.
After this patch, The jumpstack validation routine is located in the
nft_chain_validate(). When new rules or new set elements are added, the
nft_table_validate() is called by the nf_tables_newrule and the
nf_tables_newsetelem. The nft_table_validate() calls the
nft_chain_validate() that visit all their children chains recursively.
So it can update depth of chain certainly.
Reproducer:
%cat ./test.sh
#!/bin/bash
nft add table ip filter
nft add chain ip filter input { type filter hook input priority 0\; }
for ((i=0;i<20;i++)); do
nft add chain ip filter a$i
done
nft add rule ip filter input jump a1
for ((i=0;i<10;i++)); do
nft add rule ip filter a$i jump a$((i+1))
done
for ((i=11;i<19;i++)); do
nft add rule ip filter a$i jump a$((i+1))
done
nft add rule ip filter a10 jump a11
Result:
[ 253.931782] WARNING: CPU: 1 PID: 0 at net/netfilter/nf_tables_core.c:186 nft_do_chain+0xacc/0xdf0 [nf_tables]
[ 253.931915] Modules linked in: nf_tables nfnetlink ip_tables x_tables
[ 253.932153] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.18.0-rc3+ #48
[ 253.932153] RIP: 0010:nft_do_chain+0xacc/0xdf0 [nf_tables]
[ 253.932153] Code: 83 f8 fb 0f 84 c7 00 00 00 e9 d0 00 00 00 83 f8 fd 74 0e 83 f8 ff 0f 84 b4 00 00 00 e9 bd 00 00 00 83 bd 64 fd ff ff 0f 76 09 <0f> 0b 31 c0 e9 bc 02 00 00 44 8b ad 64 fd
[ 253.933807] RSP: 0018:ffff88011b807570 EFLAGS: 00010212
[ 253.933807] RAX: 00000000fffffffd RBX: ffff88011b807660 RCX: 0000000000000000
[ 253.933807] RDX: 0000000000000010 RSI: ffff880112b39d78 RDI: ffff88011b807670
[ 253.933807] RBP: ffff88011b807850 R08: ffffed0023700ece R09: ffffed0023700ecd
[ 253.933807] R10: ffff88011b80766f R11: ffffed0023700ece R12: ffff88011b807898
[ 253.933807] R13: ffff880112b39d80 R14: ffff880112b39d60 R15: dffffc0000000000
[ 253.933807] FS: 0000000000000000(0000) GS:ffff88011b800000(0000) knlGS:0000000000000000
[ 253.933807] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 253.933807] CR2: 00000000014f1008 CR3: 000000006b216000 CR4: 00000000001006e0
[ 253.933807] Call Trace:
[ 253.933807] <IRQ>
[ 253.933807] ? sched_clock_cpu+0x132/0x170
[ 253.933807] ? __nft_trace_packet+0x180/0x180 [nf_tables]
[ 253.933807] ? sched_clock_cpu+0x132/0x170
[ 253.933807] ? debug_show_all_locks+0x290/0x290
[ 253.933807] ? __lock_acquire+0x4835/0x4af0
[ 253.933807] ? inet_ehash_locks_alloc+0x1a0/0x1a0
[ 253.933807] ? unwind_next_frame+0x159e/0x1840
[ 253.933807] ? __read_once_size_nocheck.constprop.4+0x5/0x10
[ 253.933807] ? nft_do_chain_ipv4+0x197/0x1e0 [nf_tables]
[ 253.933807] ? nft_do_chain+0x5/0xdf0 [nf_tables]
[ 253.933807] nft_do_chain_ipv4+0x197/0x1e0 [nf_tables]
[ 253.933807] ? nft_do_chain_arp+0xb0/0xb0 [nf_tables]
[ 253.933807] ? __lock_is_held+0x9d/0x130
[ 253.933807] nf_hook_slow+0xc4/0x150
[ 253.933807] ip_local_deliver+0x28b/0x380
[ 253.933807] ? ip_call_ra_chain+0x3e0/0x3e0
[ 253.933807] ? ip_rcv_finish+0x1610/0x1610
[ 253.933807] ip_rcv+0xbcc/0xcc0
[ 253.933807] ? debug_show_all_locks+0x290/0x290
[ 253.933807] ? ip_local_deliver+0x380/0x380
[ 253.933807] ? __lock_is_held+0x9d/0x130
[ 253.933807] ? ip_local_deliver+0x380/0x380
[ 253.933807] __netif_receive_skb_core+0x1c9c/0x2240
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-07-17 20:48:24 +02:00
..
2017-07-11 06:08:58 -04:00
2018-06-28 10:40:47 -07:00
2018-01-19 14:02:12 -05:00
2018-06-28 10:40:47 -07:00
2018-07-17 20:48:24 +02:00
2018-06-18 14:13:25 +02:00
2017-04-05 10:15:20 +02:00
2018-05-16 07:24:30 +02:00
2018-06-28 10:40:47 -07:00
2018-07-07 22:01:08 +09:00
2017-04-12 22:02:36 +02:00
2018-03-23 21:52:19 -04:00
2018-05-29 10:12:45 -04:00
2018-03-27 23:03:00 +01:00
2017-11-02 11:10:55 +01:00
2017-10-05 18:44:17 -07:00
2017-11-02 11:10:55 +01:00
2018-01-15 14:53:43 -05:00
2017-11-02 11:10:55 +01:00
2018-05-16 07:23:35 +02:00
2018-04-19 16:11:11 -04:00
2017-05-27 18:51:41 -04:00
2018-05-16 12:15:11 -04:00
2018-05-26 09:16:44 +02:00
2017-07-04 22:35:16 +01:00
2018-05-23 11:21:35 +02:00
2017-07-04 01:29:04 -07:00
2018-04-02 20:16:17 +02:00
2017-11-02 11:10:55 +01:00
2018-05-24 14:22:59 -07:00
2018-06-05 12:32:37 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-10-18 12:39:36 +01:00
2017-11-30 09:54:25 -05:00
2017-11-04 09:26:51 +09:00
2018-05-11 12:03:06 -04:00
2017-11-02 11:10:55 +01:00
2018-03-05 12:52:45 -05:00
2017-11-04 09:26:51 +09:00
2017-11-02 11:10:55 +01:00
2018-03-05 12:52:45 -05:00
2018-05-20 18:31:42 -04:00
2017-11-02 11:10:55 +01:00
2018-02-28 11:43:28 -05:00
2018-05-28 22:59:54 -04:00
2017-11-01 11:50:43 +09:00
2018-04-23 10:21:24 -04:00
2017-11-02 11:10:55 +01:00
2018-05-11 20:53:22 -04:00
2018-03-04 13:04:23 -05:00
2017-11-02 11:10:55 +01:00
2017-10-30 21:09:24 +09:00
2017-10-11 09:49:34 +02:00
2017-11-02 11:10:55 +01:00
2017-12-08 13:32:26 -05:00
2017-11-16 10:49:00 +09:00
2017-11-02 11:10:55 +01:00
2018-02-27 14:46:26 -05:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-12-11 14:10:06 -05:00
2017-11-02 11:10:55 +01:00
2018-02-22 21:13:02 +01:00
2018-05-29 10:12:45 -04:00
2018-04-22 21:12:00 -04:00
2017-08-07 11:39:22 -07:00
2018-03-31 02:15:43 +02:00
2018-05-10 17:43:55 -04:00
2017-11-04 09:26:51 +09:00
2018-03-31 23:25:39 -04:00
2017-12-03 10:18:28 -05:00
2018-04-26 15:08:04 -04:00
2018-06-05 10:45:24 -04:00
2017-11-02 11:10:55 +01:00
2018-06-20 07:57:23 +09:00
2018-07-04 15:22:13 +09:00
2017-12-15 12:34:00 -05:00
2018-05-22 10:51:09 +02:00
2018-05-10 15:13:33 -04:00
2018-06-11 14:24:32 -07:00
2018-05-23 15:14:12 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-07-16 11:20:06 -07:00
2017-11-02 11:10:55 +01:00
2018-03-27 09:51:23 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-10-25 12:06:25 +09:00
2018-04-22 14:55:03 -04:00
2017-07-04 22:35:15 +01:00
2018-02-14 14:43:32 -05:00
2018-05-23 11:06:10 +02:00
2017-11-02 11:10:55 +01:00
2017-04-01 20:21:44 -07:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-04-25 13:19:59 -04:00
2018-05-28 22:59:54 -04:00
2018-06-18 14:13:25 +02:00
2017-11-02 11:10:55 +01:00
2018-03-04 13:04:23 -05:00
2017-07-01 07:39:09 -07:00
2017-11-02 11:10:55 +01:00
2018-05-16 07:23:35 +02:00
2018-04-07 22:32:31 -04:00
2017-11-08 16:12:33 +09:00
2017-11-02 11:10:55 +01:00
2018-05-24 18:36:15 -07:00
2018-05-16 07:23:35 +02:00
2018-06-27 10:46:43 +09:00
2018-01-16 14:56:54 -05:00
2017-11-02 11:10:55 +01:00
2017-10-01 03:55:47 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-05-16 07:23:35 +02:00
2017-11-02 11:10:55 +01:00
2017-12-05 14:37:13 -05:00
2018-03-29 11:11:40 +02:00
2017-10-20 13:21:36 +01:00
2018-05-16 07:23:35 +02:00
2018-05-29 10:12:45 -04:00
2018-03-13 18:37:02 +02:00
2018-05-31 22:48:46 -04:00
2018-05-29 09:49:15 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-05-24 11:57:35 +02:00
2018-05-24 11:57:35 +02:00
2018-04-11 10:33:46 -04:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-06-06 18:39:49 -07:00
2018-03-01 21:21:36 -05:00
2017-11-02 11:10:55 +01:00
2018-06-06 14:07:53 -04:00
2018-05-03 13:46:47 -04:00
2018-02-21 15:06:05 -05:00
2018-07-13 18:30:19 -07:00
2018-05-08 00:02:41 -04:00
2018-06-28 10:40:47 -07:00
2018-06-08 19:55:15 -04:00
2017-11-02 11:10:55 +01:00
2017-08-29 15:16:52 -07:00
2017-11-02 11:10:55 +01:00
2018-06-28 10:40:47 -07:00
2018-02-16 15:57:42 -05:00
2018-04-17 13:53:13 -04:00
2018-01-24 19:13:45 -05:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2018-07-02 18:37:12 -07:00
2018-06-05 15:46:26 +02:00
2018-06-06 16:34:00 -07:00