lkml.org 
[lkml]   [2021]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.11 21/23] netfilter: x_tables: fix compat match/target pad out-of-bound write
    Date
    From: Florian Westphal <fw@strlen.de>

    commit b29c457a6511435960115c0f548c4360d5f4801d upstream.

    xt_compat_match/target_from_user doesn't check that zeroing the area
    to start of next rule won't write past end of allocated ruleset blob.

    Remove this code and zero the entire blob beforehand.

    Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
    Reported-by: Andy Nguyen <theflow@google.com>
    Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/netfilter/arp_tables.c | 2 ++
    net/ipv4/netfilter/ip_tables.c | 2 ++
    net/ipv6/netfilter/ip6_tables.c | 2 ++
    net/netfilter/x_tables.c | 10 ++--------
    4 files changed, 8 insertions(+), 8 deletions(-)

    --- a/net/ipv4/netfilter/arp_tables.c
    +++ b/net/ipv4/netfilter/arp_tables.c
    @@ -1193,6 +1193,8 @@ static int translate_compat_table(struct
    if (!newinfo)
    goto out_unlock;

    + memset(newinfo->entries, 0, size);
    +
    newinfo->number = compatr->num_entries;
    for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
    newinfo->hook_entry[i] = compatr->hook_entry[i];
    --- a/net/ipv4/netfilter/ip_tables.c
    +++ b/net/ipv4/netfilter/ip_tables.c
    @@ -1428,6 +1428,8 @@ translate_compat_table(struct net *net,
    if (!newinfo)
    goto out_unlock;

    + memset(newinfo->entries, 0, size);
    +
    newinfo->number = compatr->num_entries;
    for (i = 0; i < NF_INET_NUMHOOKS; i++) {
    newinfo->hook_entry[i] = compatr->hook_entry[i];
    --- a/net/ipv6/netfilter/ip6_tables.c
    +++ b/net/ipv6/netfilter/ip6_tables.c
    @@ -1443,6 +1443,8 @@ translate_compat_table(struct net *net,
    if (!newinfo)
    goto out_unlock;

    + memset(newinfo->entries, 0, size);
    +
    newinfo->number = compatr->num_entries;
    for (i = 0; i < NF_INET_NUMHOOKS; i++) {
    newinfo->hook_entry[i] = compatr->hook_entry[i];
    --- a/net/netfilter/x_tables.c
    +++ b/net/netfilter/x_tables.c
    @@ -733,7 +733,7 @@ void xt_compat_match_from_user(struct xt
    {
    const struct xt_match *match = m->u.kernel.match;
    struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
    - int pad, off = xt_compat_match_offset(match);
    + int off = xt_compat_match_offset(match);
    u_int16_t msize = cm->u.user.match_size;
    char name[sizeof(m->u.user.name)];

    @@ -743,9 +743,6 @@ void xt_compat_match_from_user(struct xt
    match->compat_from_user(m->data, cm->data);
    else
    memcpy(m->data, cm->data, msize - sizeof(*cm));
    - pad = XT_ALIGN(match->matchsize) - match->matchsize;
    - if (pad > 0)
    - memset(m->data + match->matchsize, 0, pad);

    msize += off;
    m->u.user.match_size = msize;
    @@ -1116,7 +1113,7 @@ void xt_compat_target_from_user(struct x
    {
    const struct xt_target *target = t->u.kernel.target;
    struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
    - int pad, off = xt_compat_target_offset(target);
    + int off = xt_compat_target_offset(target);
    u_int16_t tsize = ct->u.user.target_size;
    char name[sizeof(t->u.user.name)];

    @@ -1126,9 +1123,6 @@ void xt_compat_target_from_user(struct x
    target->compat_from_user(t->data, ct->data);
    else
    memcpy(t->data, ct->data, tsize - sizeof(*ct));
    - pad = XT_ALIGN(target->targetsize) - target->targetsize;
    - if (pad > 0)
    - memset(t->data + target->targetsize, 0, pad);

    tsize += off;
    t->u.user.target_size = tsize;

    \
     
     \ /
      Last update: 2021-04-15 17:40    [W:4.213 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site