Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2cb9536 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "netfilter: x_tables: make sure e->next_offset covers remaining blob size"

parents 0e878df1 30115522

net/ipv4/netfilter/arp_tables.c

+12 −11
Original line number Diff line number Diff line
@@ -470,14 +470,12 @@ static int mark_source_chains(const struct xt_table_info *newinfo, 
	return 1;

}



static inline int check_entry(const struct arpt_entry *e, const char *name)

static inline int check_entry(const struct arpt_entry *e)

{

	const struct xt_entry_target *t;



	if (!arp_checkentry(&e->arp)) {

		duprintf("arp_tables: arp check failed %p %s.\n", e, name);

	if (!arp_checkentry(&e->arp))

		return -EINVAL;

	}



	if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)

		return -EINVAL;
@@ -518,10 +516,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) 
	struct xt_target *target;

	int ret;



	ret = check_entry(e, name);

	if (ret)

		return ret;



	t = arpt_get_target(e);

	target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,

					t->u.user.revision);
@@ -566,9 +560,11 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, 
					     unsigned int valid_hooks)

{

	unsigned int h;

	int err;



	if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct arpt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p\n", e);

		return -EINVAL;

	}
@@ -580,6 +576,10 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e, 
		return -EINVAL;

	}



	err = check_entry(e);

	if (err)

		return err;



	/* Check hooks & underflows */

	for (h = 0; h < NF_ARP_NUMHOOKS; h++) {

		if (!(valid_hooks & (1 << h)))
@@ -1224,7 +1224,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e, 


	duprintf("check_compat_entry_size_and_hooks %p\n", e);

	if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p, limit = %p\n", e, limit);

		return -EINVAL;

	}
@@ -1237,7 +1238,7 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e, 
	}



	/* For purposes of check_entry casting the compat entry is fine */

	ret = check_entry((struct arpt_entry *)e, name);

	ret = check_entry((struct arpt_entry *)e);

	if (ret)

		return ret;

net/ipv4/netfilter/ip_tables.c

+12 −11
Original line number Diff line number Diff line
@@ -564,14 +564,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net) 
}



static int

check_entry(const struct ipt_entry *e, const char *name)

check_entry(const struct ipt_entry *e)

{

	const struct xt_entry_target *t;



	if (!ip_checkentry(&e->ip)) {

		duprintf("ip check failed %p %s.\n", e, name);

	if (!ip_checkentry(&e->ip))

		return -EINVAL;

	}



	if (e->target_offset + sizeof(struct xt_entry_target) >

	    e->next_offset)
@@ -661,10 +659,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, 
	struct xt_mtchk_param mtpar;

	struct xt_entry_match *ematch;



	ret = check_entry(e, name);

	if (ret)

		return ret;



	j = 0;

	mtpar.net	= net;

	mtpar.table     = name;
@@ -728,9 +722,11 @@ check_entry_size_and_hooks(struct ipt_entry *e, 
			   unsigned int valid_hooks)

{

	unsigned int h;

	int err;



	if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct ipt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p\n", e);

		return -EINVAL;

	}
@@ -742,6 +738,10 @@ check_entry_size_and_hooks(struct ipt_entry *e, 
		return -EINVAL;

	}



	err = check_entry(e);

	if (err)

		return err;



	/* Check hooks & underflows */

	for (h = 0; h < NF_INET_NUMHOOKS; h++) {

		if (!(valid_hooks & (1 << h)))
@@ -1489,7 +1489,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, 


	duprintf("check_compat_entry_size_and_hooks %p\n", e);

	if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p, limit = %p\n", e, limit);

		return -EINVAL;

	}
@@ -1502,7 +1503,7 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, 
	}



	/* For purposes of check_entry casting the compat entry is fine */

	ret = check_entry((struct ipt_entry *)e, name);

	ret = check_entry((struct ipt_entry *)e);

	if (ret)

		return ret;

net/ipv6/netfilter/ip6_tables.c

+12 −11
Original line number Diff line number Diff line
@@ -574,14 +574,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net) 
}



static int

check_entry(const struct ip6t_entry *e, const char *name)

check_entry(const struct ip6t_entry *e)

{

	const struct xt_entry_target *t;



	if (!ip6_checkentry(&e->ipv6)) {

		duprintf("ip_tables: ip check failed %p %s.\n", e, name);

	if (!ip6_checkentry(&e->ipv6))

		return -EINVAL;

	}



	if (e->target_offset + sizeof(struct xt_entry_target) >

	    e->next_offset)
@@ -672,10 +670,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, 
	struct xt_mtchk_param mtpar;

	struct xt_entry_match *ematch;



	ret = check_entry(e, name);

	if (ret)

		return ret;



	j = 0;

	mtpar.net	= net;

	mtpar.table     = name;
@@ -739,9 +733,11 @@ check_entry_size_and_hooks(struct ip6t_entry *e, 
			   unsigned int valid_hooks)

{

	unsigned int h;

	int err;



	if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p\n", e);

		return -EINVAL;

	}
@@ -753,6 +749,10 @@ check_entry_size_and_hooks(struct ip6t_entry *e, 
		return -EINVAL;

	}



	err = check_entry(e);

	if (err)

		return err;



	/* Check hooks & underflows */

	for (h = 0; h < NF_INET_NUMHOOKS; h++) {

		if (!(valid_hooks & (1 << h)))
@@ -1501,7 +1501,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, 


	duprintf("check_compat_entry_size_and_hooks %p\n", e);

	if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||

	    (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {

	    (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||

	    (unsigned char *)e + e->next_offset > limit) {

		duprintf("Bad offset %p, limit = %p\n", e, limit);

		return -EINVAL;

	}
@@ -1514,7 +1515,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, 
	}



	/* For purposes of check_entry casting the compat entry is fine */

	ret = check_entry((struct ip6t_entry *)e, name);

	ret = check_entry((struct ip6t_entry *)e);

	if (ret)

		return ret;