lkml.org 
[lkml]   [2019]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.2 058/123] netfilter: ebtables: also count base chain policies
    Date
    From: Florian Westphal <fw@strlen.de>

    [ Upstream commit 3b48300d5cc7c7bed63fddb006c4046549ed4aec ]

    ebtables doesn't include the base chain policies in the rule count,
    so we need to add them manually when we call into the x_tables core
    to allocate space for the comapt offset table.

    This lead syzbot to trigger:
    WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649
    xt_compat_add_offset.cold+0x11/0x36 net/netfilter/x_tables.c:649

    Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com
    Fixes: 2035f3ff8eaa ("netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bridge/netfilter/ebtables.c | 28 +++++++++++++++++-----------
    1 file changed, 17 insertions(+), 11 deletions(-)

    diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
    index fd84b48e48b57..c8177a89f52c3 100644
    --- a/net/bridge/netfilter/ebtables.c
    +++ b/net/bridge/netfilter/ebtables.c
    @@ -1770,20 +1770,28 @@ static int compat_calc_entry(const struct ebt_entry *e,
    return 0;
    }

    +static int ebt_compat_init_offsets(unsigned int number)
    +{
    + if (number > INT_MAX)
    + return -EINVAL;
    +
    + /* also count the base chain policies */
    + number += NF_BR_NUMHOOKS;
    +
    + return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
    +}

    static int compat_table_info(const struct ebt_table_info *info,
    struct compat_ebt_replace *newinfo)
    {
    unsigned int size = info->entries_size;
    const void *entries = info->entries;
    + int ret;

    newinfo->entries_size = size;
    - if (info->nentries) {
    - int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
    - info->nentries);
    - if (ret)
    - return ret;
    - }
    + ret = ebt_compat_init_offsets(info->nentries);
    + if (ret)
    + return ret;

    return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
    entries, newinfo);
    @@ -2234,11 +2242,9 @@ static int compat_do_replace(struct net *net, void __user *user,

    xt_compat_lock(NFPROTO_BRIDGE);

    - if (tmp.nentries) {
    - ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
    - if (ret < 0)
    - goto out_unlock;
    - }
    + ret = ebt_compat_init_offsets(tmp.nentries);
    + if (ret < 0)
    + goto out_unlock;

    ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
    if (ret < 0)
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-08-14 04:56    [W:4.020 / U:0.796 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site