From nobody Mon Jun 15 22:03:19 2026 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2B1C381AE2 for ; Tue, 14 Apr 2026 07:46:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776152766; cv=none; b=q8fiSmCZ5QOW/vrf0M+jvCOPyXG0f5FKZLFqcRt8BCTieoepRV0hRTgtUoR1KhDb0amaL4As/s8dqR088TcFLIOyOyk6forkLHSAichQ0SuDKMdIXnHxTFJaWXG3yy2C9lECOPZ2nXbyv+dvI8yulgb27JZE6idtyqxWsms4D0g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776152766; c=relaxed/simple; bh=DfB0mirF1DEkQjuoNptFwzK6i/M1Tn12oXTw9xXN1to=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ors/nN/3r+5mBuT4ZD6sdMR3fmx5oVqUim+/Y3nOH//BhbrkdvihiViPLL9ggf12X3PZYdCdcBaGfPuG7WhUTWLMHYmNyQX7hKzKDUbgBWUqM6HWonI5losNIr0vrzKfIoPV0vCVRuf+FtkyOXp02nZ24/EDQ7mAzZ2Ng0/X+PI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cztyEdwS; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cztyEdwS" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2b299b3c739so22422745ad.3 for ; Tue, 14 Apr 2026 00:46:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776152764; x=1776757564; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=dBkAfCIQelOdIl4mYrxfodBgX+TU3tBvysXFS7GqOZs=; b=cztyEdwSWAMqhLeokF4PROuM52kLFXgeJfdy/Uyjp8HZETZ/v6yEhOXywatbVHod3N OGednMgtSNqxl5lmQNpadxh4THgQQoTcD1sw8jQxbk3dyAt0xRXpId9/1otcsRPzMhVB NBhn1hle5XZtN9bbIVtRGd0g9TYdvOqAhzN7mBTRYaIpxiBeva7YgUnW4ZQO7WF+tdQO 3ztyGuTAa0TobtJLZ6/O07UNLDXGo3TCoqdAf1Fpeza8jb/JSUX/MN21NjPf7ELOQylX DSj2DH6oW4uqbqcwqeCS2eERRItUzWE1brPzsP/zF8tKvm2njXRN8lRQKzmuoeOe6Ryi EhaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776152764; x=1776757564; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=dBkAfCIQelOdIl4mYrxfodBgX+TU3tBvysXFS7GqOZs=; b=NSZR0trMPWgPRQAgIhyVQiCeIynPoAfm9ZECVKtFPUAO0pYvn0HtvP9pDFma5ISp1a 2B5CF8MeQ6Pt13UYII4hawuUNxvK5MA3kauS0BJAx16hbNGxlKs3mdxHjBIP3Wd/H0zo x1905JzHJR7fH+OrvueiKPVE4lAZ5yoxXo+Q7kkqFeiMSAItDvOLeiI5Tr+6/djuqWDC MBNw7NbJfu/1N3PKmObfeHkQo6bDoqyGGVc+yD4S2NnscdFYJZDS02wBwv0ANwUgPsVH Z8FFglVya6fOAuvEKwjmo9Bgr2RuydkA59FGGuTPRikLzrZKi1FNgJ6fp21TPunDDZfh e8Xg== X-Forwarded-Encrypted: i=1; AFNElJ+zfZ3TZJTgCcZBTR1e8rHl4DL4FD0ND1iTbDO17m6ytcGEW5UeUqgBGnIVSm8RK+eu/TsTxIup3u1jR3k=@vger.kernel.org X-Gm-Message-State: AOJu0Yw8ezWgrwl+ii1PT8aUoSYFBJZPG6VWHNb3SFgvmce6K4T+p2Ob +owz1yGASErVhEzOO3VOXI6hUt/2I+rsDCmJuBPxocjl7cYUy8SVRvaQ X-Gm-Gg: AeBDiesWngU5SUKdqpGNsvEbUpxNx59vicN9Z+IjVzL5TJrxhgjaFamN4lNK9azYDgj CPvf2VJeXaflwmDzache36BxsKW1OqGQRGuS3UMCeFuP8i6jilHJEdohQ06/PWZ13UB8pVCoCOk 8qqpjaxaGezUk+PNacaNH85g5r53hYnmDAlAPDwVs7cudxlMGn+5EN3lsITvFxfQ3UxqXtGYonM EEEwZDIY6yDvPnM0J5plkfUXqCciIyv8zJF8gscsdBXNfucrFRYIwVASBYjwQhOwt9o1r2vkOA3 iG79C1DPNev4a2RnRblgJgnmPoWjlQXtH8POO+J36vBEgbTDsAbKOgvAbnCwLJAoZMh2by/GBZt ziDZIb6GoNBxVVHMVT6jMA0UnQQKKZUVCHtOyoFBE3RMjBj8Gox284hUwTc7evllj8vqqpJIc4F ZYAJwTEs+CW7cHTdBLh/LYMhNWC4H9FW2D X-Received: by 2002:a17:903:3d07:b0:2b0:ac1e:9737 with SMTP id d9443c01a7336-2b2d597d19fmr168198035ad.12.1776152763875; Tue, 14 Apr 2026 00:46:03 -0700 (PDT) Received: from localhost.localdomain ([180.167.178.215]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2eae817fcsm97892455ad.44.2026.04.14.00.46.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Apr 2026 00:46:03 -0700 (PDT) From: "Kito Xu (veritas501)" To: pablo@netfilter.org Cc: "Kito Xu (veritas501)" , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Fernando Fernandez Mancera , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] netfilter: nfnetlink_osf: fix null-ptr-deref in nf_osf_ttl Date: Tue, 14 Apr 2026 15:45:56 +0800 Message-ID: <20260414074556.2512750-1-hxzene@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nf_osf_ttl() calls __in_dev_get_rcu(skb->dev) and passes the result to in_dev_for_each_ifa_rcu() without checking for NULL. When the receiving device has no IPv4 configuration (ip_ptr is NULL), __in_dev_get_rcu() returns NULL and in_dev_for_each_ifa_rcu() dereferences it unconditionally, causing a kernel crash. This can happen when a packet arrives on a device that has had its IPv4 configuration removed (e.g., MTU set below IPV4_MIN_MTU causing inetdev_destroy) or on a device that was never assigned an IPv4 address, while an xt_osf or nft_osf rule with TTL_LESS mode is active and the packet TTL exceeds the fingerprint TTL. Add a NULL check for in_dev before the iteration. When in_dev is NULL, return 0 (no match) since source-address locality cannot be determined without IPv4 addresses on the device. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:nf_osf_match_one+0x204/0xa70 Call Trace: nf_osf_match+0x2f8/0x780 xt_osf_match_packet+0x11c/0x1f0 ipt_do_table+0x7fe/0x12b0 nf_hook_slow+0xac/0x1e0 ip_rcv+0x123/0x370 __netif_receive_skb_one_core+0x166/0x1b0 process_backlog+0x197/0x590 __napi_poll+0xa1/0x540 net_rx_action+0x401/0xd80 handle_softirqs+0x19f/0x610 Fixes: a218dc82f0b5 ("netfilter: nft_osf: Add ttl option support") Signed-off-by: Kito Xu (veritas501) --- net/netfilter/nfnetlink_osf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c index d64ce21c7b55..85dbd47dbbd4 100644 --- a/net/netfilter/nfnetlink_osf.c +++ b/net/netfilter/nfnetlink_osf.c @@ -43,6 +43,9 @@ static inline int nf_osf_ttl(const struct sk_buff *skb, else if (ip->ttl <=3D f_ttl) return 1; =20 + if (!in_dev) + return 0; + in_dev_for_each_ifa_rcu(ifa, in_dev) { if (inet_ifa_match(ip->saddr, ifa)) { ret =3D (ip->ttl =3D=3D f_ttl); --=20 2.43.0