Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 12ec8025 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman
Browse files

netfilter: x_tables: fix compat match/target pad out-of-bound write 



commit b29c457a6511435960115c0f548c4360d5f4801d upstream.

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: default avatar <syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com>
Reported-by: default avatarAndy Nguyen <theflow@google.com>
Fixes: 9fa492cd ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 854e8c24

net/ipv4/netfilter/arp_tables.c

+2 −0
Original line number Diff line number Diff line
@@ -1195,6 +1195,8 @@ static int translate_compat_table(struct net *net, 
	if (!newinfo)

		goto out_unlock;



	memset(newinfo->entries, 0, size);



	newinfo->number = compatr->num_entries;

	for (i = 0; i < NF_ARP_NUMHOOKS; i++) {

		newinfo->hook_entry[i] = compatr->hook_entry[i];

net/ipv4/netfilter/ip_tables.c

+2 −0
Original line number Diff line number Diff line
@@ -1433,6 +1433,8 @@ translate_compat_table(struct net *net, 
	if (!newinfo)

		goto out_unlock;



	memset(newinfo->entries, 0, size);



	newinfo->number = compatr->num_entries;

	for (i = 0; i < NF_INET_NUMHOOKS; i++) {

		newinfo->hook_entry[i] = compatr->hook_entry[i];

net/ipv6/netfilter/ip6_tables.c

+2 −0
Original line number Diff line number Diff line
@@ -1448,6 +1448,8 @@ translate_compat_table(struct net *net, 
	if (!newinfo)

		goto out_unlock;



	memset(newinfo->entries, 0, size);



	newinfo->number = compatr->num_entries;

	for (i = 0; i < NF_INET_NUMHOOKS; i++) {

		newinfo->hook_entry[i] = compatr->hook_entry[i];

net/netfilter/x_tables.c

+2 −8
Original line number Diff line number Diff line
@@ -738,7 +738,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, 
{

	const struct xt_match *match = m->u.kernel.match;

	struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;

	int pad, off = xt_compat_match_offset(match);

	int off = xt_compat_match_offset(match);

	u_int16_t msize = cm->u.user.match_size;

	char name[sizeof(m->u.user.name)];
@@ -748,9 +748,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, 
		match->compat_from_user(m->data, cm->data);

	else

		memcpy(m->data, cm->data, msize - sizeof(*cm));

	pad = XT_ALIGN(match->matchsize) - match->matchsize;

	if (pad > 0)

		memset(m->data + match->matchsize, 0, pad);



	msize += off;

	m->u.user.match_size = msize;
@@ -1121,7 +1118,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, 
{

	const struct xt_target *target = t->u.kernel.target;

	struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;

	int pad, off = xt_compat_target_offset(target);

	int off = xt_compat_target_offset(target);

	u_int16_t tsize = ct->u.user.target_size;

	char name[sizeof(t->u.user.name)];
@@ -1131,9 +1128,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, 
		target->compat_from_user(t->data, ct->data);

	else

		memcpy(t->data, ct->data, tsize - sizeof(*ct));

	pad = XT_ALIGN(target->targetsize) - target->targetsize;

	if (pad > 0)

		memset(t->data + target->targetsize, 0, pad);



	tsize += off;

	t->u.user.target_size = tsize;