Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7800007c authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETFILTER]: x_tables: don't use __copy_{from,to}_user on unchecked memory in compat layer 



Noticed by Linus Torvalds <torvalds@osdl.org>

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7582e9d1

net/ipv4/netfilter/ip_tables.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -1441,7 +1441,7 @@ static int compat_copy_entry_to_user(struct ipt_entry *e, 
	ret = -EFAULT;

	ret = -EFAULT;

	origsize = *size;

	origsize = *size;

	ce = (struct compat_ipt_entry __user *)*dstptr;

	ce = (struct compat_ipt_entry __user *)*dstptr;

	if (__copy_to_user(ce, e, sizeof(struct ipt_entry)))

	if (copy_to_user(ce, e, sizeof(struct ipt_entry)))

		goto out;

		goto out;





	*dstptr += sizeof(struct compat_ipt_entry);

	*dstptr += sizeof(struct compat_ipt_entry);
@@ -1459,9 +1459,9 @@ static int compat_copy_entry_to_user(struct ipt_entry *e, 
		goto out;

		goto out;

	ret = -EFAULT;

	ret = -EFAULT;

	next_offset = e->next_offset - (origsize - *size);

	next_offset = e->next_offset - (origsize - *size);

	if (__put_user(target_offset, &ce->target_offset))

	if (put_user(target_offset, &ce->target_offset))

		goto out;

		goto out;

	if (__put_user(next_offset, &ce->next_offset))

	if (put_user(next_offset, &ce->next_offset))

		goto out;

		goto out;

	return 0;

	return 0;

out:

out:

net/netfilter/x_tables.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -289,7 +289,7 @@ int xt_compat_match(void *match, void **dstptr, int *size, int convert) 
		case COMPAT_TO_USER:

		case COMPAT_TO_USER:

			pm = (struct xt_entry_match *)match;

			pm = (struct xt_entry_match *)match;

			msize = pm->u.user.match_size;

			msize = pm->u.user.match_size;

			if (__copy_to_user(*dstptr, pm, msize)) {

			if (copy_to_user(*dstptr, pm, msize)) {

				ret = -EFAULT;

				ret = -EFAULT;

				break;

				break;

			}

			}
@@ -366,7 +366,7 @@ int xt_compat_target(void *target, void **dstptr, int *size, int convert) 
		case COMPAT_TO_USER:

		case COMPAT_TO_USER:

			pt = (struct xt_entry_target *)target;

			pt = (struct xt_entry_target *)target;

			tsize = pt->u.user.target_size;

			tsize = pt->u.user.target_size;

			if (__copy_to_user(*dstptr, pt, tsize)) {

			if (copy_to_user(*dstptr, pt, tsize)) {

				ret = -EFAULT;

				ret = -EFAULT;

				break;

				break;

			}

			}