Re: [PATCH nf] netfilter: nft_set_rbtree: reject expired interval ends

["Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>]

On 2026-10-06 01:05, Pablo Neira Ayuso wrote:
> Hi,
> 
> On Mon, Oct 05, 2026 at 08:04:05PM +0000, Jérémy Jean wrote:
>> Consider two ranges in a netfilter verdict map:
>> * keys 10-19 accept packets, and
>> * keys 30-39 jump to chain 'victim'.
>> Now, delete the end marker at 20. The lookup array now uses element 30
>> as the first range's end, so an INTERVAL_END query for key 15 returns
>> element 30, including its jump verdict and chain pointer. This can 
>> make
>> KASAN reports a UAF after the GC releases reference chain for 30 that
>> has expired:
>> 
>>   BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110
>>   Read of size 8 at addr ff110000009dfb58 by task repro/50
>>   ...
>>   Call Trace:
>>   ...
>>    nft_verdict_dump+0xdd/0x110
>>    nft_data_dump+0x4d/0x80
>>    nf_tables_fill_setelem+0x30b/0x8a0
>>    ? __asan_memcpy+0x3c/0x60
>>    nf_tables_fill_setelem_info+0x1b0/0x200
>>    nft_get_set_elem+0x3fd/0x4b0
>>   ...
>>   Freed by task 24:
>>   ...
>>    kfree+0x1a5/0x280
>>    nf_tables_trans_destroy_work+0x2cb/0x520
>> 
>> Reject expired endpoints in nft_rbtree_get() before returning them.
>> 
>> Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search 
>> array in get command")
>> Cc: stable@vger.kernel.org
>> Assisted-by: LLM
>> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>> ---
>>  net/netfilter/nft_set_rbtree.c | 2 ++
>>  1 file changed, 2 insertions(+)
>> 
>> diff --git a/net/netfilter/nft_set_rbtree.c 
>> b/net/netfilter/nft_set_rbtree.c
>> index 9894832..1fd9cbe 100644
>> --- a/net/netfilter/nft_set_rbtree.c
>> +++ b/net/netfilter/nft_set_rbtree.c
>> @@ -187,6 +187,8 @@ nft_rbtree_get(const struct net *net, const struct 
>> nft_set *set,
>>  	if (flags & NFT_SET_ELEM_INTERVAL_END) {
>>  		if (!interval->to)
>>  			return NULL;
>> +		if (nft_set_elem_expired(interval->to))
>> +			return ERR_PTR(-ENOENT);
>> 
>>  		rbe = container_of(interval->to, struct nft_rbtree_elem, ext);
>>  	} else {
>> --
>> 2.47.3
> 
> 
> Can you test this fix instead? Thanks

Hello Pablo,

Thanks for this improved fix. I replayed the reproducer I had that 
triggers the
bug on the kernel that includes your patch, and I confirm that it fixes 
the UAF.

Let me know if I could be of further assistance.

Regards,
Jérémy