Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 30115522 authored by Florian Westphal's avatar Florian Westphal Committed by Gerrit - the friendly Code Review server
Browse files

netfilter: x_tables: make sure e->next_offset covers remaining blob size 



Otherwise this function may read data beyond the ruleset blob.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDennis Cagle <d-cagle@codeaurora.org>
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Git-commit: 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91
(cherry picked from commit 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91)
Change-Id: Idcfb2fffba72618a5fda1c6cc94394ed4f79be93
parent 953a5927

net/ipv4/netfilter/arp_tables.c

+4 −2
Original line number Diff line number Diff line
@@ -563,7 +563,8 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, 
	int err;



	if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct arpt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p\n", e);

		return -EINVAL;

	}
@@ -1223,7 +1224,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e, 


	duprintf("check_compat_entry_size_and_hooks %p\n", e);

	if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p, limit = %p\n", e, limit);

		return -EINVAL;

	}

net/ipv4/netfilter/ip_tables.c

+4 −2
Original line number Diff line number Diff line
@@ -726,7 +726,8 @@ check_entry_size_and_hooks(struct ipt_entry *e, 
	int err;



	if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct ipt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p\n", e);

		return -EINVAL;

	}
@@ -1489,7 +1490,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, 


	duprintf("check_compat_entry_size_and_hooks %p\n", e);

	if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p, limit = %p\n", e, limit);

		return -EINVAL;

	}

net/ipv6/netfilter/ip6_tables.c

+4 −2
Original line number Diff line number Diff line
@@ -737,7 +737,8 @@ check_entry_size_and_hooks(struct ip6t_entry *e, 
	int err;



	if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p\n", e);

		return -EINVAL;

	}
@@ -1501,7 +1502,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, 


	duprintf("check_compat_entry_size_and_hooks %p\n", e);

	if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p, limit = %p\n", e, limit);

		return -EINVAL;

	}