lkml.org 
[lkml]   [2016]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 003/180] netfilter: x_tables: validate e->target_offset early
    Date
    From: Florian Westphal <fw@strlen.de>

    commit bdf533de6968e9686df777dc178486f600c6e617 upstream.

    We should check that e->target_offset is sane before
    mark_source_chains gets called since it will fetch the target entry
    for loop detection.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    net/ipv4/netfilter/arp_tables.c | 17 ++++++++---------
    net/ipv4/netfilter/ip_tables.c | 17 ++++++++---------
    net/ipv6/netfilter/ip6_tables.c | 17 ++++++++---------
    3 files changed, 24 insertions(+), 27 deletions(-)

    diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
    index c8abe31..269759d 100644
    --- a/net/ipv4/netfilter/arp_tables.c
    +++ b/net/ipv4/netfilter/arp_tables.c
    @@ -465,14 +465,12 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
    return 1;
    }

    -static inline int check_entry(const struct arpt_entry *e, const char *name)
    +static inline int check_entry(const struct arpt_entry *e)
    {
    const struct xt_entry_target *t;

    - if (!arp_checkentry(&e->arp)) {
    - duprintf("arp_tables: arp check failed %p %s.\n", e, name);
    + if (!arp_checkentry(&e->arp))
    return -EINVAL;
    - }

    if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
    return -EINVAL;
    @@ -513,10 +511,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size)
    struct xt_target *target;
    int ret;

    - ret = check_entry(e, name);
    - if (ret)
    - return ret;
    -
    t = arpt_get_target(e);
    target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,
    t->u.user.revision);
    @@ -561,6 +555,7 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
    unsigned int valid_hooks)
    {
    unsigned int h;
    + int err;

    if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
    (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
    @@ -575,6 +570,10 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
    return -EINVAL;
    }

    + err = check_entry(e);
    + if (err)
    + return err;
    +
    /* Check hooks & underflows */
    for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
    if (!(valid_hooks & (1 << h)))
    @@ -1232,7 +1231,7 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
    }

    /* For purposes of check_entry casting the compat entry is fine */
    - ret = check_entry((struct arpt_entry *)e, name);
    + ret = check_entry((struct arpt_entry *)e);
    if (ret)
    return ret;

    diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
    index 651c107..5ca478f 100644
    --- a/net/ipv4/netfilter/ip_tables.c
    +++ b/net/ipv4/netfilter/ip_tables.c
    @@ -560,14 +560,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
    }

    static int
    -check_entry(const struct ipt_entry *e, const char *name)
    +check_entry(const struct ipt_entry *e)
    {
    const struct xt_entry_target *t;

    - if (!ip_checkentry(&e->ip)) {
    - duprintf("ip check failed %p %s.\n", e, name);
    + if (!ip_checkentry(&e->ip))
    return -EINVAL;
    - }

    if (e->target_offset + sizeof(struct xt_entry_target) >
    e->next_offset)
    @@ -657,10 +655,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
    struct xt_mtchk_param mtpar;
    struct xt_entry_match *ematch;

    - ret = check_entry(e, name);
    - if (ret)
    - return ret;
    -
    j = 0;
    mtpar.net = net;
    mtpar.table = name;
    @@ -724,6 +718,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
    unsigned int valid_hooks)
    {
    unsigned int h;
    + int err;

    if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
    (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
    @@ -738,6 +733,10 @@ check_entry_size_and_hooks(struct ipt_entry *e,
    return -EINVAL;
    }

    + err = check_entry(e);
    + if (err)
    + return err;
    +
    /* Check hooks & underflows */
    for (h = 0; h < NF_INET_NUMHOOKS; h++) {
    if (!(valid_hooks & (1 << h)))
    @@ -1498,7 +1497,7 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
    }

    /* For purposes of check_entry casting the compat entry is fine */
    - ret = check_entry((struct ipt_entry *)e, name);
    + ret = check_entry((struct ipt_entry *)e);
    if (ret)
    return ret;

    diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
    index 89a4e4d..597f539 100644
    --- a/net/ipv6/netfilter/ip6_tables.c
    +++ b/net/ipv6/netfilter/ip6_tables.c
    @@ -570,14 +570,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
    }

    static int
    -check_entry(const struct ip6t_entry *e, const char *name)
    +check_entry(const struct ip6t_entry *e)
    {
    const struct xt_entry_target *t;

    - if (!ip6_checkentry(&e->ipv6)) {
    - duprintf("ip_tables: ip check failed %p %s.\n", e, name);
    + if (!ip6_checkentry(&e->ipv6))
    return -EINVAL;
    - }

    if (e->target_offset + sizeof(struct xt_entry_target) >
    e->next_offset)
    @@ -668,10 +666,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
    struct xt_mtchk_param mtpar;
    struct xt_entry_match *ematch;

    - ret = check_entry(e, name);
    - if (ret)
    - return ret;
    -
    j = 0;
    mtpar.net = net;
    mtpar.table = name;
    @@ -735,6 +729,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
    unsigned int valid_hooks)
    {
    unsigned int h;
    + int err;

    if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
    (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
    @@ -749,6 +744,10 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
    return -EINVAL;
    }

    + err = check_entry(e);
    + if (err)
    + return err;
    +
    /* Check hooks & underflows */
    for (h = 0; h < NF_INET_NUMHOOKS; h++) {
    if (!(valid_hooks & (1 << h)))
    @@ -1510,7 +1509,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
    }

    /* For purposes of check_entry casting the compat entry is fine */
    - ret = check_entry((struct ip6t_entry *)e, name);
    + ret = check_entry((struct ip6t_entry *)e);
    if (ret)
    return ret;

    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2016-09-17 09:57    [W:4.022 / U:0.400 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site