On Thu, Jun 23, 2016 at 11:13:47AM +0200, Florian Westphal wrote:

Florian Westphal [off-list ref] wrote:

quoted

Greg Kroah-Hartman [off-list ref] wrote:

quoted

3.14-stable review patch.  If anyone has any objections, please let me know.

I have -- this doesn't work in 3.14 as t->entries (the ruleset blob)
is still kept percpu.

quoted

+static bool find_jump_target(const struct xt_table_info *t,
+			     const struct arpt_entry *target)
+{
+	struct arpt_entry *iter;
+
+	xt_entry_foreach(iter, t->entries, t->size) {

.. so this causes in kernel soft lockup when I try to insert a rule.

I will go over the 3.14 stable queue and see if I can amend this to work
with 3.14.

This amended patch works for me (iptables-test.py passes except those
tests that I expected to fail due to some missing features in 3.14).

I also briefly tried 32bit iptables/ip6tables and that seems happy
as well.  The reproduces for the two bugs fail with -EINVAL.

ebtables doesn't work (even ebtables -A INPUT -j ACCEPT fails), but
that should be solved by picking up
d26e2c9ffa385dd1b646f43c1397ba12af9e, "Revert "netfilter: ensure number
of counters is >0 in do_replace()" [ its a PARTIAL revert, so don't drop
the original patch ... ]

Subject: netfilter: x_tables: validate targets of jumps

commit 36472341017529e2b12573093cc0f68719300997 upstream.

When we see a jump also check that the offset gets us to beginning of
a rule (an ipt_entry).

The extra overhead is negible, even with absurd cases.

300k custom rules, 300k jumps to 'next' user chain:
[ plus one jump from INPUT to first userchain ]:

Before:
real    0m24.874s
user    0m7.532s
sys     0m16.076s

After:
real    0m27.464s
user    0m7.436s
sys     0m18.840s

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Need to pass the start of the ruleset as extra argument as
 t->entries won't work in 3.14 (its percpu and not even set
 up for all processors at this point).

Thank you for the update, now applied.

greg k-h