Commit 1c759b36 authored by Liping Zhang's avatar Liping Zhang Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: fix oops when inserting an element into a verdict map

commit 58c78e10


Dalegaard says:
 The following ruleset, when loaded with 'nft -f bad.txt'
 flush ruleset
 table ip inlinenat {
   map sourcemap {
     type ipv4_addr : verdict;

   chain postrouting {
     ip saddr vmap @sourcemap accept
 add chain inlinenat test
 add element inlinenat sourcemap { : jump test }

 results in a kernel oops:
 BUG: unable to handle kernel paging request at 0000000000001344
 IP: [<ffffffffa07bf704>] nf_tables_check_loops+0x114/0x1f0 [nf_tables]
 Call Trace:
  [<ffffffffa07c2aae>] ? nft_data_init+0x13e/0x1a0 [nf_tables]
  [<ffffffffa07c1950>] nft_validate_register_store+0x60/0xb0 [nf_tables]
  [<ffffffffa07c74b5>] nft_add_set_elem+0x545/0x5e0 [nf_tables]
  [<ffffffffa07bfdd0>] ? nft_table_lookup+0x30/0x60 [nf_tables]
  [<ffffffff8132c630>] ? nla_strcmp+0x40/0x50
  [<ffffffffa07c766e>] nf_tables_newsetelem+0x11e/0x210 [nf_tables]
  [<ffffffff8132c400>] ? nla_validate+0x60/0x80
  [<ffffffffa030d9b4>] nfnetlink_rcv+0x354/0x5a7 [nfnetlink]

Because we forget to fill the net pointer in bind_ctx, so dereferencing
it may cause kernel crash.

Reported-by: default avatarDalegaard <>
Signed-off-by: default avatarLiping Zhang <>
Signed-off-by: default avatarPablo Neira Ayuso <>
Signed-off-by: default avatarAmit Pundir <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent 65c2ca73
......@@ -3452,6 +3452,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
dreg = nft_type_to_reg(set->dtype);
list_for_each_entry(binding, &set->bindings, list) {
struct nft_ctx bind_ctx = {
.net = ctx->net,
.afi = ctx->afi,
.table = ctx->table,
.chain = (struct nft_chain *)binding->chain,
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment