Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae5c6821 authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max 



The helper->expect_class_max must be set to the total number of
expect_policy minus 1, since we will use the statement "if (class >
helper->expect_class_max)" to validate the CTA_EXPECT_CLASS attr in
ctnetlink_alloc_expect.

So for compatibility, set the helper->expect_class_max to the
NFCTH_POLICY_SET_NUM attr's value minus 1.

Also: it's invalid when the NFCTH_POLICY_SET_NUM attr's value is zero.
1. this will result "expect_policy = kzalloc(0, GFP_KERNEL);";
2. we cannot set the helper->expect_class_max to a proper value.

So if nla_get_be32(tb[NFCTH_POLICY_SET_NUM]) is zero, report -EINVAL to
the userspace.

Signed-off-by: default avatarLiping Zhang <zlpnobody@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent db7f00b8

net/netfilter/nfnetlink_cthelper.c

+11 −9
Original line number Diff line number Diff line
@@ -161,6 +161,7 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, 
	int i, ret;

	struct nf_conntrack_expect_policy *expect_policy;

	struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];

	unsigned int class_max;



	ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,

			       nfnl_cthelper_expect_policy_set);
@@ -170,19 +171,18 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, 
	if (!tb[NFCTH_POLICY_SET_NUM])

		return -EINVAL;



	helper->expect_class_max =

		ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));



	if (helper->expect_class_max != 0 &&

	    helper->expect_class_max > NF_CT_MAX_EXPECT_CLASSES)

	class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));

	if (class_max == 0)

		return -EINVAL;

	if (class_max > NF_CT_MAX_EXPECT_CLASSES)

		return -EOVERFLOW;



	expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *

				helper->expect_class_max, GFP_KERNEL);

				class_max, GFP_KERNEL);

	if (expect_policy == NULL)

		return -ENOMEM;



	for (i=0; i<helper->expect_class_max; i++) {

	for (i = 0; i < class_max; i++) {

		if (!tb[NFCTH_POLICY_SET+i])

			goto err;
@@ -191,6 +191,8 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, 
		if (ret < 0)

			goto err;

	}



	helper->expect_class_max = class_max - 1;

	helper->expect_policy = expect_policy;

	return 0;

err:
@@ -377,10 +379,10 @@ nfnl_cthelper_dump_policy(struct sk_buff *skb, 
		goto nla_put_failure;



	if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,

			 htonl(helper->expect_class_max)))

			 htonl(helper->expect_class_max + 1)))

		goto nla_put_failure;



	for (i=0; i<helper->expect_class_max; i++) {

	for (i = 0; i < helper->expect_class_max + 1; i++) {

		nest_parms2 = nla_nest_start(skb,

				(NFCTH_POLICY_SET+i) | NLA_F_NESTED);

		if (nest_parms2 == NULL)