Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb5b579b authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: validate registers coming from userspace. 



[ 6e1acfa387b9ff82cfc7db8cc3b6959221a95851 ]

Bail out in case userspace uses unsupported registers.

Fixes: 49499c3e ("netfilter: nf_tables: switch registers to 32 bit addressing")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent cfe1b971

net/netfilter/nf_tables_api.c

+17 −14
Original line number Diff line number Diff line
@@ -7384,26 +7384,23 @@ int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest) 
}

EXPORT_SYMBOL_GPL(nft_parse_u32_check);



/**

 *	nft_parse_register - parse a register value from a netlink attribute

 *

 *	@attr: netlink attribute

 *

 *	Parse and translate a register value from a netlink attribute.

 *	Registers used to be 128 bit wide, these register numbers will be

 *	mapped to the corresponding 32 bit register numbers.

 */

static unsigned int nft_parse_register(const struct nlattr *attr)

static int nft_parse_register(const struct nlattr *attr, u32 *preg)

{

	unsigned int reg;



	reg = ntohl(nla_get_be32(attr));

	switch (reg) {

	case NFT_REG_VERDICT...NFT_REG_4:

		return reg * NFT_REG_SIZE / NFT_REG32_SIZE;

		*preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE;

		break;

	case NFT_REG32_00...NFT_REG32_15:

		*preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;

		break;

	default:

		return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00;

		return -ERANGE;

	}



	return 0;

}



/**
@@ -7454,7 +7451,10 @@ int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len) 
	u32 reg;

	int err;



	reg = nft_parse_register(attr);

	err = nft_parse_register(attr, &reg);

	if (err < 0)

		return err;



	err = nft_validate_register_load(reg, len);

	if (err < 0)

		return err;
@@ -7523,7 +7523,10 @@ int nft_parse_register_store(const struct nft_ctx *ctx, 
	int err;

	u32 reg;



	reg = nft_parse_register(attr);

	err = nft_parse_register(attr, &reg);

	if (err < 0)

		return err;



	err = nft_validate_register_store(ctx, reg, data, type, len);

	if (err < 0)

		return err;