netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit

syzbot reports:
BUG: KASAN: slab-out-of-bounds in __list_del_entry_valid+0xcc/0xf0 lib/list_debug.c:42
[..]
 list_del include/linux/list.h:148 [inline]
 cttimeout_net_exit+0x211/0x540 net/netfilter/nfnetlink_cttimeout.c:617

No reproducer so far. Looking at recent changes in this area
its clear that the free_head must not be at the end of the
structure because nf_ct_timeout structure has variable size.

Reported-by: <syzbot+92968395eedbdbd3617d@syzkaller.appspotmail.com>
Fixes: 7336c1976b8c ("netfilter: cttimeout: decouple unlink and free on netns destruction")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index f069c24c61461ab1bc722a332ff72d7c1a0e9cf9..af15102bc696fa2ed665e3056e30f63d8bc7f8fa 100644 (file)
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -35,12 +35,13 @@ static unsigned int nfct_timeout_id __read_mostly;
 
 struct ctnl_timeout {
        struct list_head        head;
+       struct list_head        free_head;
        struct rcu_head         rcu_head;
        refcount_t              refcnt;
        char                    name[CTNL_TIMEOUT_NAME_MAX];
-       struct nf_ct_timeout    timeout;
 
-       struct list_head        free_head;
+       /* must be at the end */
+       struct nf_ct_timeout    timeout;
 };
 
 struct nfct_timeout_pernet {