Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 953a5927 authored by Florian Westphal's avatar Florian Westphal Committed by Gerrit - the friendly Code Review server
Browse files

netfilter: x_tables: validate e->target_offset early 



We should check that e->target_offset is sane before
mark_source_chains gets called since it will fetch the target entry
for loop detection.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDennis Cagle <d-cagle@codeaurora.org>
Git-repo: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Git-commit: bdf533de6968e9686df777dc178486f600c6e617
(cherry picked from commit bdf533de6968e9686df777dc178486f600c6e617)
Change-Id: Id3ec56cdc333990d62c99d6c2e59dbcce633bcc1
parent 338e6cc3

net/ipv4/netfilter/arp_tables.c

+8 −9
Original line number Diff line number Diff line
@@ -470,14 +470,12 @@ static int mark_source_chains(const struct xt_table_info *newinfo, 
	return 1;

}



static inline int check_entry(const struct arpt_entry *e, const char *name)

static inline int check_entry(const struct arpt_entry *e)

{

	const struct xt_entry_target *t;



	if (!arp_checkentry(&e->arp)) {

		duprintf("arp_tables: arp check failed %p %s.\n", e, name);

	if (!arp_checkentry(&e->arp))

		return -EINVAL;

	}



	if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)

		return -EINVAL;
@@ -518,10 +516,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) 
	struct xt_target *target;

	int ret;



	ret = check_entry(e, name);

	if (ret)

		return ret;



	t = arpt_get_target(e);

	target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,

					t->u.user.revision);
@@ -566,6 +560,7 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, 
					     unsigned int valid_hooks)

{

	unsigned int h;

	int err;



	if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
@@ -580,6 +575,10 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, 
		return -EINVAL;

	}



	err = check_entry(e);

	if (err)

		return err;



	/* Check hooks & underflows */

	for (h = 0; h < NF_ARP_NUMHOOKS; h++) {

		if (!(valid_hooks & (1 << h)))
@@ -1237,7 +1236,7 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e, 
	}



	/* For purposes of check_entry casting the compat entry is fine */

	ret = check_entry((struct arpt_entry *)e, name);

	ret = check_entry((struct arpt_entry *)e);

	if (ret)

		return ret;

net/ipv4/netfilter/ip_tables.c

+8 −9
Original line number Diff line number Diff line
@@ -565,14 +565,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net) 
}



static int

check_entry(const struct ipt_entry *e, const char *name)

check_entry(const struct ipt_entry *e)

{

	const struct xt_entry_target *t;



	if (!ip_checkentry(&e->ip)) {

		duprintf("ip check failed %p %s.\n", e, name);

	if (!ip_checkentry(&e->ip))

		return -EINVAL;

	}



	if (e->target_offset + sizeof(struct xt_entry_target) >

	    e->next_offset)
@@ -662,10 +660,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, 
	struct xt_mtchk_param mtpar;

	struct xt_entry_match *ematch;



	ret = check_entry(e, name);

	if (ret)

		return ret;



	j = 0;

	mtpar.net	= net;

	mtpar.table     = name;
@@ -729,6 +723,7 @@ check_entry_size_and_hooks(struct ipt_entry *e, 
			   unsigned int valid_hooks)

{

	unsigned int h;

	int err;



	if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
@@ -743,6 +738,10 @@ check_entry_size_and_hooks(struct ipt_entry *e, 
		return -EINVAL;

	}



	err = check_entry(e);

	if (err)

		return err;



	/* Check hooks & underflows */

	for (h = 0; h < NF_INET_NUMHOOKS; h++) {

		if (!(valid_hooks & (1 << h)))
@@ -1503,7 +1502,7 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, 
	}



	/* For purposes of check_entry casting the compat entry is fine */

	ret = check_entry((struct ipt_entry *)e, name);

	ret = check_entry((struct ipt_entry *)e);

	if (ret)

		return ret;

net/ipv6/netfilter/ip6_tables.c

+8 −9
Original line number Diff line number Diff line
@@ -575,14 +575,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net) 
}



static int

check_entry(const struct ip6t_entry *e, const char *name)

check_entry(const struct ip6t_entry *e)

{

	const struct xt_entry_target *t;



	if (!ip6_checkentry(&e->ipv6)) {

		duprintf("ip_tables: ip check failed %p %s.\n", e, name);

	if (!ip6_checkentry(&e->ipv6))

		return -EINVAL;

	}



	if (e->target_offset + sizeof(struct xt_entry_target) >

	    e->next_offset)
@@ -673,10 +671,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, 
	struct xt_mtchk_param mtpar;

	struct xt_entry_match *ematch;



	ret = check_entry(e, name);

	if (ret)

		return ret;



	j = 0;

	mtpar.net	= net;

	mtpar.table     = name;
@@ -740,6 +734,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e, 
			   unsigned int valid_hooks)

{

	unsigned int h;

	int err;



	if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
@@ -754,6 +749,10 @@ check_entry_size_and_hooks(struct ip6t_entry *e, 
		return -EINVAL;

	}



	err = check_entry(e);

	if (err)

		return err;



	/* Check hooks & underflows */

	for (h = 0; h < NF_INET_NUMHOOKS; h++) {

		if (!(valid_hooks & (1 << h)))
@@ -1515,7 +1514,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, 
	}



	/* For purposes of check_entry casting the compat entry is fine */

	ret = check_entry((struct ip6t_entry *)e, name);

	ret = check_entry((struct ip6t_entry *)e);

	if (ret)

		return ret;