Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8039ab43 authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Pablo Neira Ayuso
Browse files

netfilter: cttimeout: remove VLA usage 

In preparation to enabling -Wvla, remove VLA and replace it
with dynamic memory allocation.

>From a security viewpoint, the use of Variable Length Arrays can be
a vector for stack overflow attacks. Also, in general, as the code
evolves it is easy to lose track of how big a VLA can get. Thus, we
can end up having segfaults that are hard to debug.

Also, fixed as part of the directive to remove all VLAs from
the kernel: https://lkml.org/lkml/2018/3/7/621



While at it, remove likely() notation which is not necessary from the
control plane code.

Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d719e3f2

net/netfilter/nfnetlink_cttimeout.c

+17 −9
Original line number Diff line number Diff line
@@ -51,19 +51,27 @@ ctnl_timeout_parse_policy(void *timeouts, 
			  const struct nf_conntrack_l4proto *l4proto,

			  struct net *net, const struct nlattr *attr)

{

	struct nlattr **tb;

	int ret = 0;



	if (likely(l4proto->ctnl_timeout.nlattr_to_obj)) {

		struct nlattr *tb[l4proto->ctnl_timeout.nlattr_max+1];

	if (!l4proto->ctnl_timeout.nlattr_to_obj)

		return 0;



	tb = kcalloc(l4proto->ctnl_timeout.nlattr_max + 1, sizeof(*tb),

		     GFP_KERNEL);



		ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max,

				       attr, l4proto->ctnl_timeout.nla_policy,

				       NULL);

	if (!tb)

		return -ENOMEM;



	ret = nla_parse_nested(tb, l4proto->ctnl_timeout.nlattr_max, attr,

			       l4proto->ctnl_timeout.nla_policy, NULL);

	if (ret < 0)

			return ret;

		goto err;



	ret = l4proto->ctnl_timeout.nlattr_to_obj(tb, net, timeouts);

	}



err:

	kfree(tb);

	return ret;

}