From patchwork Mon May 13 10:27:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 13663305 X-Patchwork-Delegate: kuba@kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8677D31A67; Mon, 13 May 2024 10:36:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715596594; cv=none; b=sukprAoKAALF1tzDEBYtn17BcXx1fOmD/mkJi/ojIoMitYRvk7dpdMObgbXsQDzEoDnPw0wjcAOB2v+XljiluUO4TOn6U11K/mgueBK2e8tQGFObmSpIgoV3/oNJJ9Q9DC+KYnflFlgmt5AEjvGsuc9we8hfuI5hEeO2ZnYNQ+8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715596594; c=relaxed/simple; bh=EnQJ6/Y3niLZ7G1ugMTNRsAicQ/lNOYNxsC18ziMyOs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dHqG2ZUrFCi0yWi+2XAUGjtV9J9tfnjpIsJjKtUIPz/2Jjyw2Q8+F3iz/TUAASQWBu0chu4Rio9Oxik0TJI7HuyKHJlAniVj5Uk5fB7C33pUjAhV6YW4S4Kcb+XN9lkNbjPHJxdzDXHaYqqTCSxe9ng2OQAj4zEjZBvpnl8HaUg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1s6T2Z-0000H5-7e; Mon, 13 May 2024 12:36:19 +0200 From: Florian Westphal To: Cc: netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com, Florian Westphal , syzbot+b94a6818504ea90d7661@syzkaller.appspotmail.com Subject: [PATCH nf] netfilter: tproxy: bail out if IP has been disabled on the device Date: Mon, 13 May 2024 12:27:15 +0200 Message-ID: <20240513102751.16105-1-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <00000000000075b694061852136a@google.com> References: <00000000000075b694061852136a@google.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: kuba@kernel.org syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 Call Trace: nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168 __in_dev_get_rcu() can return NULL, so check for this. Reported-and-tested-by: syzbot+b94a6818504ea90d7661@syzkaller.appspotmail.com Fixes: cc6eb4338569 ("tproxy: use the interface primary IP address as a default value for --on-ip") Signed-off-by: Florian Westphal --- net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c index 69e331799604..73e66a088e25 100644 --- a/net/ipv4/netfilter/nf_tproxy_ipv4.c +++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c @@ -58,6 +58,8 @@ __be32 nf_tproxy_laddr4(struct sk_buff *skb, __be32 user_laddr, __be32 daddr) laddr = 0; indev = __in_dev_get_rcu(skb->dev); + if (!indev) + return daddr; in_dev_for_each_ifa_rcu(ifa, indev) { if (ifa->ifa_flags & IFA_F_SECONDARY)