add fix for DoS via nftables

diff --git a/0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch b/0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch
new file mode 100644 (file)
index 0000000..edf749f
--- /dev/null
+++ b/0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch
@@ -0,0 +1,54 @@
+From 6fa9fc0ce1032710ce017c444b0c66eaf9e77782 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 22 May 2017 00:17:30 +0200
+Subject: [PATCH linux] netfilter: nft_set_rbtree: handle re-addition element
+ after deletion
+
+The existing code selects no next branch to be inspected when
+re-inserting an inactive element into the rb-tree, looping endlessly.
+This patch restricts the check for active elements to the EEXIST case
+only.
+
+Fixes: e701001e7cbe ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates")
+Reported-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ net/netfilter/nft_set_rbtree.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index f06f55e..51ff879 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -118,17 +118,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
+               else if (d > 0)
+                       p = &parent->rb_right;
+               else {
+-                      if (nft_set_elem_active(&rbe->ext, genmask)) {
+-                              if (nft_rbtree_interval_end(rbe) &&
+-                                  !nft_rbtree_interval_end(new))
+-                                      p = &parent->rb_left;
+-                              else if (!nft_rbtree_interval_end(rbe) &&
+-                                       nft_rbtree_interval_end(new))
+-                                      p = &parent->rb_right;
+-                              else {
+-                                      *ext = &rbe->ext;
+-                                      return -EEXIST;
+-                              }
++                      if (nft_rbtree_interval_end(rbe) &&
++                          !nft_rbtree_interval_end(new)) {
++                              p = &parent->rb_left;
++                      } else if (!nft_rbtree_interval_end(rbe) &&
++                                 nft_rbtree_interval_end(new)) {
++                              p = &parent->rb_right;
++                      } else if (nft_set_elem_active(&rbe->ext, genmask)) {
++                              *ext = &rbe->ext;
++                              return -EEXIST;
++                      } else {
++                              p = &parent->rb_left;
+                       }
+               }
+       }
+-- 
+2.1.4
+

diff --git a/Makefile b/Makefile
index 45d9e3bd66f1e9905ea28a8d3024e66fc1cfb2e8..d10525661176a55b0c1ff1b93fb6d62dbd90403b 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -240,6 +240,7 @@ ${KERNEL_SRC}/README ${KERNEL_CFG_ORG}: ${KERNEL_SRC_SUBMODULE} | submodules
        cd ${KERNEL_SRC}; patch -p1 < ../swapops-0002-Revert-mm-ksm-convert-write_protect_page-to-use-page.patch
        cd ${KERNEL_SRC}; patch -p1 < ../swapops-0003-Revert-mm-introduce-page_vma_mapped_walk.patch
        cd ${KERNEL_SRC}; patch -p1 < ../swapops-0004-mm-ksm-handle-protnone-saved-writes-when-making-page.patch
+       cd ${KERNEL_SRC}; patch -p1 < ../0001-netfilter-nft_set_rbtree-handle-re-addition-element-.patch # DoS from within (unpriv) containers
        sed -i ${KERNEL_SRC}/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=${EXTRAVERSION}/'
        touch $@