[PATCH nf] netfilter: nft_set_rbtree: reject expired interval ends

[PATCH nf] netfilter: nft_set_rbtree: reject expired interval ends

[Jérémy Jean]

Consider two ranges in a netfilter verdict map:
* keys 10-19 accept packets, and
* keys 30-39 jump to chain 'victim'.
Now, delete the end marker at 20. The lookup array now uses element 30
as the first range's end, so an INTERVAL_END query for key 15 returns
element 30, including its jump verdict and chain pointer. This can make
KASAN reports a UAF after the GC releases reference chain for 30 that
has expired:

  BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110
  Read of size 8 at addr ff110000009dfb58 by task repro/50
  ...
  Call Trace:
  ...
   nft_verdict_dump+0xdd/0x110
   nft_data_dump+0x4d/0x80
   nf_tables_fill_setelem+0x30b/0x8a0
   ? __asan_memcpy+0x3c/0x60
   nf_tables_fill_setelem_info+0x1b0/0x200
   nft_get_set_elem+0x3fd/0x4b0
  ...
  Freed by task 24:
  ...
   kfree+0x1a5/0x280
   nf_tables_trans_destroy_work+0x2cb/0x520

Reject expired endpoints in nft_rbtree_get() before returning them.

Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 net/netfilter/nft_set_rbtree.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 9894832..1fd9cbe 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -187,6 +187,8 @@ nft_rbtree_get(const struct net *net, const struct nft_set *set,
 	if (flags & NFT_SET_ELEM_INTERVAL_END) {
 		if (!interval->to)
 			return NULL;
+		if (nft_set_elem_expired(interval->to))
+			return ERR_PTR(-ENOENT);
 
 		rbe = container_of(interval->to, struct nft_rbtree_elem, ext);
 	} else {
-- 
2.47.3

Re: [PATCH nf] netfilter: nft_set_rbtree: reject expired interval ends

[Pablo Neira Ayuso]

On Mon, Oct 05, 2026 at 08:04:05PM +0000, Jérémy Jean wrote:
> Consider two ranges in a netfilter verdict map:
> * keys 10-19 accept packets, and
> * keys 30-39 jump to chain 'victim'.
> Now, delete the end marker at 20. The lookup array now uses element 30
> as the first range's end, so an INTERVAL_END query for key 15 returns
> element 30, including its jump verdict and chain pointer. This can make
> KASAN reports a UAF after the GC releases reference chain for 30 that
> has expired:
> 
>   BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110
>   Read of size 8 at addr ff110000009dfb58 by task repro/50
>   ...
>   Call Trace:
>   ...
>    nft_verdict_dump+0xdd/0x110
>    nft_data_dump+0x4d/0x80
>    nf_tables_fill_setelem+0x30b/0x8a0
>    ? __asan_memcpy+0x3c/0x60
>    nf_tables_fill_setelem_info+0x1b0/0x200
>    nft_get_set_elem+0x3fd/0x4b0
>   ...
>   Freed by task 24:
>   ...
>    kfree+0x1a5/0x280
>    nf_tables_trans_destroy_work+0x2cb/0x520
> 
> Reject expired endpoints in nft_rbtree_get() before returning them.
> 
> Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>  net/netfilter/nft_set_rbtree.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
> index 9894832..1fd9cbe 100644
> --- a/net/netfilter/nft_set_rbtree.c
> +++ b/net/netfilter/nft_set_rbtree.c
> @@ -187,6 +187,8 @@ nft_rbtree_get(const struct net *net, const struct nft_set *set,
>  	if (flags & NFT_SET_ELEM_INTERVAL_END) {
>  		if (!interval->to)
>  			return NULL;
> +		if (nft_set_elem_expired(interval->to))
> +			return ERR_PTR(-ENOENT);

End elements carry no timeout set extension.

>  		rbe = container_of(interval->to, struct nft_rbtree_elem, ext);
>  	} else {
> -- 
> 2.47.3
> 

Re: [PATCH nf] netfilter: nft_set_rbtree: reject expired interval ends

[Pablo Neira Ayuso]

On Mon, Oct 05, 2026 at 11:20:57PM +0200, Pablo Neira Ayuso wrote:
> On Mon, Oct 05, 2026 at 08:04:05PM +0000, Jérémy Jean wrote:
> > Consider two ranges in a netfilter verdict map:
> > * keys 10-19 accept packets, and
> > * keys 30-39 jump to chain 'victim'.
> > Now, delete the end marker at 20. The lookup array now uses element 30
> > as the first range's end, so an INTERVAL_END query for key 15 returns
> > element 30, including its jump verdict and chain pointer. This can make
> > KASAN reports a UAF after the GC releases reference chain for 30 that
> > has expired:
> > 
> >   BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110
> >   Read of size 8 at addr ff110000009dfb58 by task repro/50
> >   ...
> >   Call Trace:
> >   ...
> >    nft_verdict_dump+0xdd/0x110
> >    nft_data_dump+0x4d/0x80
> >    nf_tables_fill_setelem+0x30b/0x8a0
> >    ? __asan_memcpy+0x3c/0x60
> >    nf_tables_fill_setelem_info+0x1b0/0x200
> >    nft_get_set_elem+0x3fd/0x4b0
> >   ...
> >   Freed by task 24:
> >   ...
> >    kfree+0x1a5/0x280
> >    nf_tables_trans_destroy_work+0x2cb/0x520
> > 
> > Reject expired endpoints in nft_rbtree_get() before returning them.
> > 
> > Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command")
> > Cc: stable@vger.kernel.org
> > Assisted-by: LLM
> > Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> > ---
> >  net/netfilter/nft_set_rbtree.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
> > index 9894832..1fd9cbe 100644
> > --- a/net/netfilter/nft_set_rbtree.c
> > +++ b/net/netfilter/nft_set_rbtree.c
> > @@ -187,6 +187,8 @@ nft_rbtree_get(const struct net *net, const struct nft_set *set,
> >  	if (flags & NFT_SET_ELEM_INTERVAL_END) {
> >  		if (!interval->to)
> >  			return NULL;
> > +		if (nft_set_elem_expired(interval->to))
> > +			return ERR_PTR(-ENOENT);
> 
> End elements carry no timeout set extension.

And nf_tables_getsetelem() is called under RCU read side lock, and
elements are released after RCU grace period.

This patch is papering the problem.

> >  		rbe = container_of(interval->to, struct nft_rbtree_elem, ext);
> >  	} else {
> > -- 
> > 2.47.3
> > 

Re: [PATCH nf] netfilter: nft_set_rbtree: reject expired interval ends

[Pablo Neira Ayuso]

[-- Attachment #1: Type: text/plain, Size: 1924 bytes --]

Hi,

On Mon, Oct 05, 2026 at 08:04:05PM +0000, Jérémy Jean wrote:
> Consider two ranges in a netfilter verdict map:
> * keys 10-19 accept packets, and
> * keys 30-39 jump to chain 'victim'.
> Now, delete the end marker at 20. The lookup array now uses element 30
> as the first range's end, so an INTERVAL_END query for key 15 returns
> element 30, including its jump verdict and chain pointer. This can make
> KASAN reports a UAF after the GC releases reference chain for 30 that
> has expired:
> 
>   BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110
>   Read of size 8 at addr ff110000009dfb58 by task repro/50
>   ...
>   Call Trace:
>   ...
>    nft_verdict_dump+0xdd/0x110
>    nft_data_dump+0x4d/0x80
>    nf_tables_fill_setelem+0x30b/0x8a0
>    ? __asan_memcpy+0x3c/0x60
>    nf_tables_fill_setelem_info+0x1b0/0x200
>    nft_get_set_elem+0x3fd/0x4b0
>   ...
>   Freed by task 24:
>   ...
>    kfree+0x1a5/0x280
>    nf_tables_trans_destroy_work+0x2cb/0x520
> 
> Reject expired endpoints in nft_rbtree_get() before returning them.
> 
> Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>  net/netfilter/nft_set_rbtree.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
> index 9894832..1fd9cbe 100644
> --- a/net/netfilter/nft_set_rbtree.c
> +++ b/net/netfilter/nft_set_rbtree.c
> @@ -187,6 +187,8 @@ nft_rbtree_get(const struct net *net, const struct nft_set *set,
>  	if (flags & NFT_SET_ELEM_INTERVAL_END) {
>  		if (!interval->to)
>  			return NULL;
> +		if (nft_set_elem_expired(interval->to))
> +			return ERR_PTR(-ENOENT);
>  
>  		rbe = container_of(interval->to, struct nft_rbtree_elem, ext);
>  	} else {
> -- 
> 2.47.3


Can you test this fix instead? Thanks

[-- Attachment #2: tentative-fix.patch --]
[-- Type: text/x-diff, Size: 639 bytes --]

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 12431b55752f..fbe1750f1ca2 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -1091,7 +1091,8 @@ static void nft_rbtree_commit(struct nft_set *set)
 		 * representation. Use next start element to complete this
 		 * interval.
 		 */
-		if (nft_rbtree_interval_start(rbe) &&
+		if (nft_set_is_anonymous(set) &&
+		    nft_rbtree_interval_start(rbe) &&
 		    nft_rbtree_interval_start(prev_rbe) &&
 		    priv->array_next->intervals[num_intervals].from)
 			priv->array_next->intervals[num_intervals++].to = &prev_rbe->ext;