Re: KASAN, xt_TCPMSS finally found nasty use-after-free bug? 4.10.8

[Denys Fedoryshchenko]

On 2017-04-02 20:26, Eric Dumazet wrote:
> On Sun, 2017-04-02 at 10:14 -0700, Eric Dumazet wrote:
>
> > Could that be that netfilter does not abort earlier if TCP header is
> > completely wrong ?
>
> Yes, I wonder if this patch would be better, unless we replicate the
> th->doff sanity check in all netfilter modules dissecting TCP frames.
>
> diff --git a/net/netfilter/xt_tcpudp.c b/net/netfilter/xt_tcpudp.c
> index
> ade024c90f4f129a7c384e9e1cbfdb8ffe73065f..8cb4eadd5ba1c20e74bc27ee52a0bc36a5b26725
> 100644
> --- a/net/netfilter/xt_tcpudp.c
> +++ b/net/netfilter/xt_tcpudp.c
> @@ -103,11 +103,11 @@ static bool tcp_mt(const struct sk_buff *skb,
> struct xt_action_param *par)
>  	if (!NF_INVF(tcpinfo, XT_TCP_INV_FLAGS,
>  		     (((unsigned char *)th)[13] & tcpinfo->flg_mask) == 
> tcpinfo->flg_cmp))
>  		return false;
> +	if (th->doff * 4 < sizeof(_tcph)) {
> +		par->hotdrop = true;
> +		return false;
> +	}
>  	if (tcpinfo->option) {
> -		if (th->doff * 4 < sizeof(_tcph)) {
> -			par->hotdrop = true;
> -			return false;
> -		}
>  		if (!tcp_find_option(tcpinfo->option, skb, par->thoff,
>  				     th->doff*4 - sizeof(_tcph),
>  				     tcpinfo->invflags & XT_TCP_INV_OPTION,
I modified patch a little as:
if (th->doff * 4 < sizeof(_tcph)) {
 par->hotdrop = true;
 WARN_ON_ONCE(!tcpinfo->option);
 return false;
}

And it did triggered WARN once at morning, and didn't hit KASAN. I will 
run for a while more, to see if it is ok, and then if stable, will try 
to enable SFQ again.