netfilter: x_tables: validate e->target_offset early
[ Upstream commit bdf533de69
]
We should check that e->target_offset is sane before
mark_source_chains gets called since it will fetch the target entry
for loop detection.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
This commit is contained in:
parent
1a1f239be5
commit
780daa25f8
|
@ -469,14 +469,12 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
|
||||||
return 1;
|
return 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
static inline int check_entry(const struct arpt_entry *e, const char *name)
|
static inline int check_entry(const struct arpt_entry *e)
|
||||||
{
|
{
|
||||||
const struct xt_entry_target *t;
|
const struct xt_entry_target *t;
|
||||||
|
|
||||||
if (!arp_checkentry(&e->arp)) {
|
if (!arp_checkentry(&e->arp))
|
||||||
duprintf("arp_tables: arp check failed %p %s.\n", e, name);
|
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
|
||||||
|
|
||||||
if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
|
if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
@ -517,10 +515,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size)
|
||||||
struct xt_target *target;
|
struct xt_target *target;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
ret = check_entry(e, name);
|
|
||||||
if (ret)
|
|
||||||
return ret;
|
|
||||||
|
|
||||||
t = arpt_get_target(e);
|
t = arpt_get_target(e);
|
||||||
target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,
|
target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,
|
||||||
t->u.user.revision);
|
t->u.user.revision);
|
||||||
|
@ -565,6 +559,7 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
|
||||||
unsigned int valid_hooks)
|
unsigned int valid_hooks)
|
||||||
{
|
{
|
||||||
unsigned int h;
|
unsigned int h;
|
||||||
|
int err;
|
||||||
|
|
||||||
if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
|
if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
|
||||||
(unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
|
(unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
|
||||||
|
@ -579,6 +574,10 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
err = check_entry(e);
|
||||||
|
if (err)
|
||||||
|
return err;
|
||||||
|
|
||||||
/* Check hooks & underflows */
|
/* Check hooks & underflows */
|
||||||
for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
|
for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
|
||||||
if (!(valid_hooks & (1 << h)))
|
if (!(valid_hooks & (1 << h)))
|
||||||
|
@ -1239,7 +1238,7 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
|
||||||
}
|
}
|
||||||
|
|
||||||
/* For purposes of check_entry casting the compat entry is fine */
|
/* For purposes of check_entry casting the compat entry is fine */
|
||||||
ret = check_entry((struct arpt_entry *)e, name);
|
ret = check_entry((struct arpt_entry *)e);
|
||||||
if (ret)
|
if (ret)
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
|
|
|
@ -564,14 +564,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
|
||||||
}
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
check_entry(const struct ipt_entry *e, const char *name)
|
check_entry(const struct ipt_entry *e)
|
||||||
{
|
{
|
||||||
const struct xt_entry_target *t;
|
const struct xt_entry_target *t;
|
||||||
|
|
||||||
if (!ip_checkentry(&e->ip)) {
|
if (!ip_checkentry(&e->ip))
|
||||||
duprintf("ip check failed %p %s.\n", e, name);
|
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
|
||||||
|
|
||||||
if (e->target_offset + sizeof(struct xt_entry_target) >
|
if (e->target_offset + sizeof(struct xt_entry_target) >
|
||||||
e->next_offset)
|
e->next_offset)
|
||||||
|
@ -661,10 +659,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
|
||||||
struct xt_mtchk_param mtpar;
|
struct xt_mtchk_param mtpar;
|
||||||
struct xt_entry_match *ematch;
|
struct xt_entry_match *ematch;
|
||||||
|
|
||||||
ret = check_entry(e, name);
|
|
||||||
if (ret)
|
|
||||||
return ret;
|
|
||||||
|
|
||||||
j = 0;
|
j = 0;
|
||||||
mtpar.net = net;
|
mtpar.net = net;
|
||||||
mtpar.table = name;
|
mtpar.table = name;
|
||||||
|
@ -728,6 +722,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
|
||||||
unsigned int valid_hooks)
|
unsigned int valid_hooks)
|
||||||
{
|
{
|
||||||
unsigned int h;
|
unsigned int h;
|
||||||
|
int err;
|
||||||
|
|
||||||
if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
|
if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
|
||||||
(unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
|
(unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
|
||||||
|
@ -742,6 +737,10 @@ check_entry_size_and_hooks(struct ipt_entry *e,
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
err = check_entry(e);
|
||||||
|
if (err)
|
||||||
|
return err;
|
||||||
|
|
||||||
/* Check hooks & underflows */
|
/* Check hooks & underflows */
|
||||||
for (h = 0; h < NF_INET_NUMHOOKS; h++) {
|
for (h = 0; h < NF_INET_NUMHOOKS; h++) {
|
||||||
if (!(valid_hooks & (1 << h)))
|
if (!(valid_hooks & (1 << h)))
|
||||||
|
@ -1505,7 +1504,7 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
|
||||||
}
|
}
|
||||||
|
|
||||||
/* For purposes of check_entry casting the compat entry is fine */
|
/* For purposes of check_entry casting the compat entry is fine */
|
||||||
ret = check_entry((struct ipt_entry *)e, name);
|
ret = check_entry((struct ipt_entry *)e);
|
||||||
if (ret)
|
if (ret)
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
|
|
|
@ -577,14 +577,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
|
||||||
}
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
check_entry(const struct ip6t_entry *e, const char *name)
|
check_entry(const struct ip6t_entry *e)
|
||||||
{
|
{
|
||||||
const struct xt_entry_target *t;
|
const struct xt_entry_target *t;
|
||||||
|
|
||||||
if (!ip6_checkentry(&e->ipv6)) {
|
if (!ip6_checkentry(&e->ipv6))
|
||||||
duprintf("ip_tables: ip check failed %p %s.\n", e, name);
|
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
|
||||||
|
|
||||||
if (e->target_offset + sizeof(struct xt_entry_target) >
|
if (e->target_offset + sizeof(struct xt_entry_target) >
|
||||||
e->next_offset)
|
e->next_offset)
|
||||||
|
@ -675,10 +673,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
|
||||||
struct xt_mtchk_param mtpar;
|
struct xt_mtchk_param mtpar;
|
||||||
struct xt_entry_match *ematch;
|
struct xt_entry_match *ematch;
|
||||||
|
|
||||||
ret = check_entry(e, name);
|
|
||||||
if (ret)
|
|
||||||
return ret;
|
|
||||||
|
|
||||||
j = 0;
|
j = 0;
|
||||||
mtpar.net = net;
|
mtpar.net = net;
|
||||||
mtpar.table = name;
|
mtpar.table = name;
|
||||||
|
@ -742,6 +736,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
|
||||||
unsigned int valid_hooks)
|
unsigned int valid_hooks)
|
||||||
{
|
{
|
||||||
unsigned int h;
|
unsigned int h;
|
||||||
|
int err;
|
||||||
|
|
||||||
if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
|
if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
|
||||||
(unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
|
(unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
|
||||||
|
@ -756,6 +751,10 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
err = check_entry(e);
|
||||||
|
if (err)
|
||||||
|
return err;
|
||||||
|
|
||||||
/* Check hooks & underflows */
|
/* Check hooks & underflows */
|
||||||
for (h = 0; h < NF_INET_NUMHOOKS; h++) {
|
for (h = 0; h < NF_INET_NUMHOOKS; h++) {
|
||||||
if (!(valid_hooks & (1 << h)))
|
if (!(valid_hooks & (1 << h)))
|
||||||
|
@ -1520,7 +1519,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
|
||||||
}
|
}
|
||||||
|
|
||||||
/* For purposes of check_entry casting the compat entry is fine */
|
/* For purposes of check_entry casting the compat entry is fine */
|
||||||
ret = check_entry((struct ip6t_entry *)e, name);
|
ret = check_entry((struct ip6t_entry *)e);
|
||||||
if (ret)
|
if (ret)
|
||||||
return ret;
|
return ret;
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue