From 86d47d4c84a1b8470ba3fc16df13ea2a220b74ff Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 7 Oct 2026 23:51:44 +0200 Subject: [PATCH] netfilter: nft_set_rbtree: narrow down range completion to anonymous sets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For anonymous sets, when adjacent ranges are found, the end element is not added to the set to pack the set representation. Use next start element to complete this interval. Jérémy Jean says: Consider two ranges in a netfilter verdict map: * keys 10-19 accept packets, and * keys 30-39 jump to chain 'victim'. Now, delete the end marker at 20. The lookup array now uses element 30 as the first range's end, so an INTERVAL_END query for key 15 returns element 30, including its jump verdict and chain pointer. This can make KASAN reports a UAF after the GC releases reference chain for 30 that has expired: BUG: KASAN: slab-use-after-free in nft_verdict_dump+0xdd/0x110 Read of size 8 at addr ff110000009dfb58 by task repro/50 ... Call Trace: ... nft_verdict_dump+0xdd/0x110 nft_data_dump+0x4d/0x80 nf_tables_fill_setelem+0x30b/0x8a0 ? __asan_memcpy+0x3c/0x60 nf_tables_fill_setelem_info+0x1b0/0x200 nft_get_set_elem+0x3fd/0x4b0 ... Freed by task 24: ... kfree+0x1a5/0x280 nf_tables_trans_destroy_work+0x2cb/0x520 Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command") Reported-by: Jérémy Jean Link: https://patch.msgid.link/netfilter-devel/20261005200404.3544062-2-Jeremy.Jean@oss.cyber.gouv.fr/ Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nft_set_rbtree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 12431b55752f..fbe1750f1ca2 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -1091,7 +1091,8 @@ static void nft_rbtree_commit(struct nft_set *set) * representation. Use next start element to complete this * interval. */ - if (nft_rbtree_interval_start(rbe) && + if (nft_set_is_anonymous(set) && + nft_rbtree_interval_start(rbe) && nft_rbtree_interval_start(prev_rbe) && priv->array_next->intervals[num_intervals].from) priv->array_next->intervals[num_intervals++].to = &prev_rbe->ext;