lkml.org 
[lkml]   [2019]   [Sep]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 21/59] netfilter: xt_nfacct: Fix alignment mismatch in xt_nfacct_match_info
    Date
    From: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>

    [ Upstream commit 89a26cd4b501e9511d3cd3d22327fc76a75a38b3 ]

    When running a 64-bit kernel with a 32-bit iptables binary, the size of
    the xt_nfacct_match_info struct diverges.

    kernel: sizeof(struct xt_nfacct_match_info) : 40
    iptables: sizeof(struct xt_nfacct_match_info)) : 36

    Trying to append nfacct related rules results in an unhelpful message.
    Although it is suggested to look for more information in dmesg, nothing
    can be found there.

    # iptables -A <chain> -m nfacct --nfacct-name <acct-object>
    iptables: Invalid argument. Run `dmesg' for more information.

    This patch fixes the memory misalignment by enforcing 8-byte alignment
    within the struct's first revision. This solution is often used in many
    other uapi netfilter headers.

    Signed-off-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
    Acked-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/uapi/linux/netfilter/xt_nfacct.h | 5 ++++
    net/netfilter/xt_nfacct.c | 36 ++++++++++++++++--------
    2 files changed, 30 insertions(+), 11 deletions(-)

    diff --git a/include/uapi/linux/netfilter/xt_nfacct.h b/include/uapi/linux/netfilter/xt_nfacct.h
    index 5c8a4d760ee34..b5123ab8d54a8 100644
    --- a/include/uapi/linux/netfilter/xt_nfacct.h
    +++ b/include/uapi/linux/netfilter/xt_nfacct.h
    @@ -11,4 +11,9 @@ struct xt_nfacct_match_info {
    struct nf_acct *nfacct;
    };

    +struct xt_nfacct_match_info_v1 {
    + char name[NFACCT_NAME_MAX];
    + struct nf_acct *nfacct __attribute__((aligned(8)));
    +};
    +
    #endif /* _XT_NFACCT_MATCH_H */
    diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
    index 6f92d25590a85..ea447b437f122 100644
    --- a/net/netfilter/xt_nfacct.c
    +++ b/net/netfilter/xt_nfacct.c
    @@ -55,25 +55,39 @@ nfacct_mt_destroy(const struct xt_mtdtor_param *par)
    nfnl_acct_put(info->nfacct);
    }

    -static struct xt_match nfacct_mt_reg __read_mostly = {
    - .name = "nfacct",
    - .family = NFPROTO_UNSPEC,
    - .checkentry = nfacct_mt_checkentry,
    - .match = nfacct_mt,
    - .destroy = nfacct_mt_destroy,
    - .matchsize = sizeof(struct xt_nfacct_match_info),
    - .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
    - .me = THIS_MODULE,
    +static struct xt_match nfacct_mt_reg[] __read_mostly = {
    + {
    + .name = "nfacct",
    + .revision = 0,
    + .family = NFPROTO_UNSPEC,
    + .checkentry = nfacct_mt_checkentry,
    + .match = nfacct_mt,
    + .destroy = nfacct_mt_destroy,
    + .matchsize = sizeof(struct xt_nfacct_match_info),
    + .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
    + .me = THIS_MODULE,
    + },
    + {
    + .name = "nfacct",
    + .revision = 1,
    + .family = NFPROTO_UNSPEC,
    + .checkentry = nfacct_mt_checkentry,
    + .match = nfacct_mt,
    + .destroy = nfacct_mt_destroy,
    + .matchsize = sizeof(struct xt_nfacct_match_info_v1),
    + .usersize = offsetof(struct xt_nfacct_match_info_v1, nfacct),
    + .me = THIS_MODULE,
    + },
    };

    static int __init nfacct_mt_init(void)
    {
    - return xt_register_match(&nfacct_mt_reg);
    + return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
    }

    static void __exit nfacct_mt_exit(void)
    {
    - xt_unregister_match(&nfacct_mt_reg);
    + xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
    }

    module_init(nfacct_mt_init);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-09-20 00:31    [W:4.268 / U:1.344 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site