diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-14 23:53:39 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-01-25 15:45:30 -0800 |
| commit | ff67e3e488090908dc015ba04d7407d8bd467f7e (patch) | |
| tree | 19c88c1c31a79eea81de122e0eca02445e4809d3 | |
| parent | 544add1f1cfb78c3dfa3e6edcf4668f6be5e730c (diff) | |
| download | linux-stable-ff67e3e488090908dc015ba04d7407d8bd467f7e.tar.gz linux-stable-ff67e3e488090908dc015ba04d7407d8bd467f7e.tar.bz2 linux-stable-ff67e3e488090908dc015ba04d7407d8bd467f7e.zip | |
netfilter: nf_tables: do not allow mismatch field size and set key length
[ Upstream commit 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 ]
The set description provides the size of each field in the set whose sum
should not mismatch the set key length, bail out otherwise.
I did not manage to crash nft_set_pipapo with mismatch fields and set key
length so far, but this is UB which must be disallowed.
Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3912a133324c..7775bf5224ac 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4811,8 +4811,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, static int nft_set_desc_concat(struct nft_set_desc *desc, const struct nlattr *nla) { + u32 num_regs = 0, key_num_regs = 0; struct nlattr *attr; - u32 num_regs = 0; int rem, err, i; nla_for_each_nested(attr, nla, rem) { @@ -4827,6 +4827,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, for (i = 0; i < desc->field_count; i++) num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); + key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); + if (key_num_regs != num_regs) + return -EINVAL; + if (num_regs > NFT_REG32_COUNT) return -E2BIG; |