lkml.org 
[lkml]   [2020]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 129/222] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
    Date
    From: Florian Westphal <fw@strlen.de>

    commit 9332d27d7918182add34e8043f6a754530fdd022 upstream.

    This WARN can trigger because some of the names fed to the module
    autoload function can be of arbitrary length.

    Remove the WARN and add limits for all NLA_STRING attributes.

    Reported-by: syzbot+0e63ae76d117ae1c3a01@syzkaller.appspotmail.com
    Fixes: 452238e8d5ffd8 ("netfilter: nf_tables: add and use helper for module autoload")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/netfilter/nf_tables_api.c | 13 +++++++++----
    1 file changed, 9 insertions(+), 4 deletions(-)

    --- a/net/netfilter/nf_tables_api.c
    +++ b/net/netfilter/nf_tables_api.c
    @@ -22,6 +22,8 @@
    #include <net/net_namespace.h>
    #include <net/sock.h>

    +#define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
    +
    static LIST_HEAD(nf_tables_expressions);
    static LIST_HEAD(nf_tables_objects);
    static LIST_HEAD(nf_tables_flowtables);
    @@ -521,7 +523,7 @@ static void nft_request_module(struct ne
    va_start(args, fmt);
    ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
    va_end(args);
    - if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
    + if (ret >= MODULE_NAME_LEN)
    return;

    mutex_unlock(&net->nft.commit_mutex);
    @@ -1174,7 +1176,8 @@ static const struct nla_policy nft_chain
    .len = NFT_CHAIN_MAXNAMELEN - 1 },
    [NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
    [NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
    - [NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
    + [NFTA_CHAIN_TYPE] = { .type = NLA_STRING,
    + .len = NFT_MODULE_AUTOLOAD_LIMIT },
    [NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
    [NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
    };
    @@ -2088,7 +2091,8 @@ static const struct nft_expr_type *nft_e
    }

    static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
    - [NFTA_EXPR_NAME] = { .type = NLA_STRING },
    + [NFTA_EXPR_NAME] = { .type = NLA_STRING,
    + .len = NFT_MODULE_AUTOLOAD_LIMIT },
    [NFTA_EXPR_DATA] = { .type = NLA_NESTED },
    };

    @@ -3931,7 +3935,8 @@ static const struct nla_policy nft_set_e
    [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
    .len = NFT_USERDATA_MAXLEN },
    [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
    - [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
    + [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING,
    + .len = NFT_OBJ_MAXNAMELEN - 1 },
    };

    static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {

    \
     
     \ /
      Last update: 2020-01-22 14:24    [W:4.016 / U:0.776 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site