lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 015/410] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florian Westphal <fw@strlen.de>

    commit b71812168571fa55e44cdd0254471331b9c4c4c6 upstream.

    We need to make sure the offsets are not out of range of the
    total size.
    Also check that they are in ascending order.

    The WARN_ON triggered by syzkaller (it sets panic_on_warn) is
    changed to also bail out, no point in continuing parsing.

    Briefly tested with simple ruleset of
    -A INPUT --limit 1/s' --log
    plus jump to custom chains using 32bit ebtables binary.

    Reported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/bridge/netfilter/ebtables.c | 13 ++++++++++++-
    1 file changed, 12 insertions(+), 1 deletion(-)

    --- a/net/bridge/netfilter/ebtables.c
    +++ b/net/bridge/netfilter/ebtables.c
    @@ -2010,7 +2010,9 @@ static int ebt_size_mwt(struct compat_eb
    if (match_kern)
    match_kern->match_size = ret;

    - WARN_ON(type == EBT_COMPAT_TARGET && size_left);
    + if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
    + return -EINVAL;
    +
    match32 = (struct compat_ebt_entry_mwt *) buf;
    }

    @@ -2067,6 +2069,15 @@ static int size_entry_mwt(struct ebt_ent
    *
    * offsets are relative to beginning of struct ebt_entry (i.e., 0).
    */
    + for (i = 0; i < 4 ; ++i) {
    + if (offsets[i] >= *total)
    + return -EINVAL;
    + if (i == 0)
    + continue;
    + if (offsets[i-1] > offsets[i])
    + return -EINVAL;
    + }
    +
    for (i = 0, j = 1 ; j < 4 ; j++, i++) {
    struct compat_ebt_entry_mwt *match32;
    unsigned int size;
    \
     
     \ /
      Last update: 2018-06-07 18:17    [W:4.039 / U:0.280 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site