Bug 1758673
| Summary: | Fix covscan-detected issues | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Phil Sutter <psutter> | ||||
| Component: | libnftnl | Assignee: | Phil Sutter <psutter> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Tomas Dolezal <todoleza> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 8.2 | CC: | todoleza | ||||
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
||||
| Target Release: | 8.2 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | libnftnl-1.1.5-4.el8 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2020-04-28 16:06:56 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Series accepted upstream, an important follow-up is still under review.
Accepted:
807ccaa5ffa4772f4d81fff6fb105ab6bbcb8b10
b82e1bf4ba811273341ad4fde272271782a8ada1
14156fa831e5652ec43552d0dd5c16a7de412261
0d5bb960b2f953c71fff15f88c8f0c331a1fa965
00b144bc9d093dbdd1a3690dc8e8fb90b5447f2d
ede1781101f669312ae513a83932f0c727738df9
Under review:
commit 6c317b4166b2e19df3560e30bf36fd59a0d88a68
Author: Phil Sutter <phil>
Date: Wed Oct 16 23:22:53 2019 +0200
obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser
This is a necessary follow-up on commit 00b144bc9d093 ("obj/ct_timeout:
Avoid array overrun in timeout_parse_attr_data()") which fixed array out
of bounds access but missed the logic behind it:
The nested attribute type values are incremented by one when being
transferred between kernel and userspace, the zero type value is
reserved for "unspecified".
Kernel uses CTA_TIMEOUT_* symbols for that, libnftnl simply mangles the
type values in nftnl_obj_ct_timeout_build().
Return path was broken as it overstepped its nlattr array but apart from
that worked: Type values were decremented by one in
timeout_parse_attr_data().
This patch moves the type value mangling into
parse_timeout_attr_policy_cb() (which still overstepped nlattr array).
Consequently, when copying values from nlattr array into ct timeout
object in timeout_parse_attr_data(), loop is adjusted to start at index
0 and the type value decrement is dropped there.
Fixes: 0adceeab1597a ("src: add ct timeout support")
Recent covscan run turned up a new problem: If nftnl_chain_get_data() is called for NFTNL_CHAIN_DEVICES, *data_len is not assigned to. This causes garbage comparison in nftnl_chain_get_u*() getters. It should be fixed by assigning 0, so these getters consistently fail. Fix sent upstream: https://lore.kernel.org/netfilter-devel/20200214172417.11217-1-phil@nwl.cc/ Upstream commit to backport:
commit 629ee38dca48651bc8c0eedf2f3a0066a6c0aa5b
Author: Phil Sutter <phil>
Date: Fri Feb 14 18:20:29 2020 +0100
src: Fix for reading garbage in nftnl_chain getters
In {s,u}{32,64} type getters nftnl_assert() is called to make sure
returned data length matches expectations. Therefore all attributes must
set data_len, which NFTNL_CHAIN_DEVICES didn't.
While being at it, do the same change for NFTNL_FLOWTABLE_DEVICES as
well to make code a bit more consistent although the problem was fixed
for flowtables with commit f8eed54150fd4 ("flowtable: Fix for reading
garbage") already (but in the other direction).
Fixes: e3ac19b5ec162 ("chain: multi-device support")
Signed-off-by: Phil Sutter <phil>
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2020:1763 |
Created attachment 1622615 [details] scan-results Among quite a few false-positives, covscan identified some real problems in libnftnl rebase. Fix them upstream, then backport the series.