Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 04bcef2a authored by Arjan van de Ven's avatar Arjan van de Ven Committed by Patrick McHardy
Browse files

ipvs: Add boundary check on ioctl arguments 



The ipvs code has a nifty system for doing the size of ioctl command
copies; it defines an array with values into which it indexes the cmd
to find the right length.

Unfortunately, the ipvs code forgot to check if the cmd was in the
range that the array provides, allowing for an index outside of the
array, which then gives a "garbage" result into the length, which
then gets used for copying into a stack buffer.

Fix this by adding sanity checks on these as well as the copy size.

[ horms@verge.net.au: adjusted limit to IP_VS_SO_GET_MAX ]
Signed-off-by: default avatarArjan van de Ven <arjan@linux.intel.com>
Acked-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarSimon Horman <horms@verge.net.au>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent ae24e578

net/netfilter/ipvs/ip_vs_ctl.c

+13 −1
Original line number Original line Diff line number Diff line
@@ -2077,6 +2077,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) 
	if (!capable(CAP_NET_ADMIN))

	if (!capable(CAP_NET_ADMIN))

		return -EPERM;

		return -EPERM;





	if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)

		return -EINVAL;

	if (len < 0 || len >  MAX_ARG_LEN)

		return -EINVAL;

	if (len != set_arglen[SET_CMDID(cmd)]) {

	if (len != set_arglen[SET_CMDID(cmd)]) {

		pr_err("set_ctl: len %u != %u\n",

		pr_err("set_ctl: len %u != %u\n",

		       len, set_arglen[SET_CMDID(cmd)]);

		       len, set_arglen[SET_CMDID(cmd)]);
@@ -2352,17 +2356,25 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) 
{

{

	unsigned char arg[128];

	unsigned char arg[128];

	int ret = 0;

	int ret = 0;

	unsigned int copylen;





	if (!capable(CAP_NET_ADMIN))

	if (!capable(CAP_NET_ADMIN))

		return -EPERM;

		return -EPERM;





	if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_GET_MAX)

		return -EINVAL;



	if (*len < get_arglen[GET_CMDID(cmd)]) {

	if (*len < get_arglen[GET_CMDID(cmd)]) {

		pr_err("get_ctl: len %u < %u\n",

		pr_err("get_ctl: len %u < %u\n",

		       *len, get_arglen[GET_CMDID(cmd)]);

		       *len, get_arglen[GET_CMDID(cmd)]);

		return -EINVAL;

		return -EINVAL;

	}

	}





	if (copy_from_user(arg, user, get_arglen[GET_CMDID(cmd)]) != 0)

	copylen = get_arglen[GET_CMDID(cmd)];

	if (copylen > 128)

		return -EINVAL;



	if (copy_from_user(arg, user, copylen) != 0)

		return -EFAULT;

		return -EFAULT;





	if (mutex_lock_interruptible(&__ip_vs_mutex))

	if (mutex_lock_interruptible(&__ip_vs_mutex))