Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6675233 authored Aug 30, 2011 by Florian Westphal Committed by Patrick McHardy Aug 30, 2011

netfilter: nf_queue: reject NF_STOLEN verdicts from userspace



A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak.

This problem was previously fixed via
64507fdb (netfilter:
nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because
NF_STOLEN can also be returned by a netfilter hook when iterating the
rules in nf_reinject.

Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw.

This is complementary to commit fad54440
(netfilter: avoid double free in nf_reinject).

Cc: Julian Anastasov <ja@ssi.bg>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>

parent 9823d9ff

net/ipv4/netfilter/ip_queue.c

+4 −7

Original line number	Original line	Diff line number	Diff line
	@@ -314,7 +314,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
	{		{
	struct nf_queue_entry *entry;		struct nf_queue_entry *entry;

	if (vmsg->value > NF_MAX_VERDICT)		if (vmsg->value > NF_MAX_VERDICT \|\| vmsg->value == NF_STOLEN)
	return -EINVAL;		return -EINVAL;

	entry = ipq_find_dequeue_entry(vmsg->id);		entry = ipq_find_dequeue_entry(vmsg->id);
	@@ -359,9 +359,6 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
	break;		break;

	case IPQM_VERDICT:		case IPQM_VERDICT:
	if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
	status = -EINVAL;
	else
	status = ipq_set_verdict(&pmsg->msg.verdict,		status = ipq_set_verdict(&pmsg->msg.verdict,
	len - sizeof(*pmsg));		len - sizeof(*pmsg));
	break;		break;

net/ipv6/netfilter/ip6_queue.c

+4 −7

Original line number	Original line	Diff line number	Diff line
	@@ -314,7 +314,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
	{		{
	struct nf_queue_entry *entry;		struct nf_queue_entry *entry;

	if (vmsg->value > NF_MAX_VERDICT)		if (vmsg->value > NF_MAX_VERDICT \|\| vmsg->value == NF_STOLEN)
	return -EINVAL;		return -EINVAL;

	entry = ipq_find_dequeue_entry(vmsg->id);		entry = ipq_find_dequeue_entry(vmsg->id);
	@@ -359,9 +359,6 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
	break;		break;

	case IPQM_VERDICT:		case IPQM_VERDICT:
	if (pmsg->msg.verdict.value > NF_MAX_VERDICT)
	status = -EINVAL;
	else
	status = ipq_set_verdict(&pmsg->msg.verdict,		status = ipq_set_verdict(&pmsg->msg.verdict,
	len - sizeof(*pmsg));		len - sizeof(*pmsg));
	break;		break;

net/netfilter/nfnetlink_queue.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -646,8 +646,8 @@ verdicthdr_get(const struct nlattr * const nfqa[])
	return NULL;		return NULL;

	vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);		vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
	verdict = ntohl(vhdr->verdict);		verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK;
	if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT)		if (verdict > NF_MAX_VERDICT \|\| verdict == NF_STOLEN)
	return NULL;		return NULL;
	return vhdr;		return vhdr;
	}		}