Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ddc8d029 authored by Yasuyuki Kozakai's avatar Yasuyuki Kozakai Committed by David S. Miller
Browse files

[NETFILTER]: nf_conntrack: check address family when finding protocol module 



__nf_conntrack_{l3}proto_find() doesn't check the passed protocol family,
then it's possible to touch out of the array which has only AF_MAX items.

Spotted by Pablo Neira Ayuso.

Signed-off-by: default avatarYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 34f9a2e4

include/net/netfilter/nf_conntrack_l3proto.h

+9 −6
Original line number Original line Diff line number Diff line
@@ -88,12 +88,6 @@ extern struct nf_conntrack_l3proto *nf_ct_l3protos[AF_MAX]; 
extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);

extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);

extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);

extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);





static inline struct nf_conntrack_l3proto *

__nf_ct_l3proto_find(u_int16_t l3proto)

{

	return nf_ct_l3protos[l3proto];

}



extern struct nf_conntrack_l3proto *

extern struct nf_conntrack_l3proto *

nf_ct_l3proto_find_get(u_int16_t l3proto);

nf_ct_l3proto_find_get(u_int16_t l3proto);
@@ -103,4 +97,13 @@ extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p); 
extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;

extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;

extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;

extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;

extern struct nf_conntrack_l3proto nf_conntrack_generic_l3proto;

extern struct nf_conntrack_l3proto nf_conntrack_generic_l3proto;



static inline struct nf_conntrack_l3proto *

__nf_ct_l3proto_find(u_int16_t l3proto)

{

	if (unlikely(l3proto >= AF_MAX))

		return &nf_conntrack_generic_l3proto;

	return nf_ct_l3protos[l3proto];

}



#endif /*_NF_CONNTRACK_L3PROTO_H*/
 
#endif /*_NF_CONNTRACK_L3PROTO_H*/

net/netfilter/nf_conntrack_core.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -188,7 +188,7 @@ extern struct nf_conntrack_protocol nf_conntrack_generic_protocol; 
struct nf_conntrack_protocol *

struct nf_conntrack_protocol *

__nf_ct_proto_find(u_int16_t l3proto, u_int8_t protocol)

__nf_ct_proto_find(u_int16_t l3proto, u_int8_t protocol)

{

{

	if (unlikely(nf_ct_protos[l3proto] == NULL))

	if (unlikely(l3proto >= AF_MAX || nf_ct_protos[l3proto] == NULL))

		return &nf_conntrack_generic_protocol;

		return &nf_conntrack_generic_protocol;





	return nf_ct_protos[l3proto][protocol];

	return nf_ct_protos[l3proto][protocol];