Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f0d1f04f authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: fix wrong arithmetics regarding NFT_REJECT_ICMPX_MAX 



NFT_REJECT_ICMPX_MAX should be __NFT_REJECT_ICMPX_MAX - 1.

nft_reject_icmp_code() and nft_reject_icmpv6_code() are called from the
packet path, so BUG_ON in case we try to access an unknown abstracted
ICMP code. This should not happen since we already validate this from
nft_reject_{inet,bridge}_init().

Fixes: 51b0a5d8 ("netfilter: nft_reject: introduce icmp code abstraction for inet and bridge")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 91c1a09b

include/uapi/linux/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -774,7 +774,7 @@ enum nft_reject_inet_code { 
	NFT_REJECT_ICMPX_ADMIN_PROHIBITED,

	__NFT_REJECT_ICMPX_MAX

};

#define NFT_REJECT_ICMPX_MAX	(__NFT_REJECT_ICMPX_MAX + 1)

#define NFT_REJECT_ICMPX_MAX	(__NFT_REJECT_ICMPX_MAX - 1)



/**

 * enum nft_reject_attributes - nf_tables reject expression netlink attributes

net/netfilter/nft_reject.c

+4 −6
Original line number Diff line number Diff line
@@ -72,7 +72,7 @@ int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr) 
}

EXPORT_SYMBOL_GPL(nft_reject_dump);



static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX] = {

static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX + 1] = {

	[NFT_REJECT_ICMPX_NO_ROUTE]		= ICMP_NET_UNREACH,

	[NFT_REJECT_ICMPX_PORT_UNREACH]		= ICMP_PORT_UNREACH,

	[NFT_REJECT_ICMPX_HOST_UNREACH]		= ICMP_HOST_UNREACH,
@@ -81,8 +81,7 @@ static u8 icmp_code_v4[NFT_REJECT_ICMPX_MAX] = { 


int nft_reject_icmp_code(u8 code)

{

	if (code > NFT_REJECT_ICMPX_MAX)

		return -EINVAL;

	BUG_ON(code > NFT_REJECT_ICMPX_MAX);



	return icmp_code_v4[code];

}
@@ -90,7 +89,7 @@ int nft_reject_icmp_code(u8 code) 
EXPORT_SYMBOL_GPL(nft_reject_icmp_code);





static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX] = {

static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX + 1] = {

	[NFT_REJECT_ICMPX_NO_ROUTE]		= ICMPV6_NOROUTE,

	[NFT_REJECT_ICMPX_PORT_UNREACH]		= ICMPV6_PORT_UNREACH,

	[NFT_REJECT_ICMPX_HOST_UNREACH]		= ICMPV6_ADDR_UNREACH,
@@ -99,8 +98,7 @@ static u8 icmp_code_v6[NFT_REJECT_ICMPX_MAX] = { 


int nft_reject_icmpv6_code(u8 code)

{

	if (code > NFT_REJECT_ICMPX_MAX)

		return -EINVAL;

	BUG_ON(code > NFT_REJECT_ICMPX_MAX);



	return icmp_code_v6[code];

}