lkml.org 
[lkml]   [2022]   [Aug]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 33/86] netfilter: nft_payload: do not truncate csum_offset and csum_type
    Date
    From: Pablo Neira Ayuso <pablo@netfilter.org>

    [ Upstream commit 7044ab281febae9e2fa9b0b247693d6026166293 ]

    Instead report ERANGE if csum_offset is too long, and EOPNOTSUPP if type
    is not support.

    Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support")
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nft_payload.c | 19 +++++++++++++------
    1 file changed, 13 insertions(+), 6 deletions(-)

    diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
    index bdb07362c0ef0..551e0d6cf63d4 100644
    --- a/net/netfilter/nft_payload.c
    +++ b/net/netfilter/nft_payload.c
    @@ -660,17 +660,23 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
    const struct nlattr * const tb[])
    {
    struct nft_payload_set *priv = nft_expr_priv(expr);
    + u32 csum_offset, csum_type = NFT_PAYLOAD_CSUM_NONE;
    + int err;

    priv->base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
    priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
    priv->len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));

    if (tb[NFTA_PAYLOAD_CSUM_TYPE])
    - priv->csum_type =
    - ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
    - if (tb[NFTA_PAYLOAD_CSUM_OFFSET])
    - priv->csum_offset =
    - ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_OFFSET]));
    + csum_type = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
    + if (tb[NFTA_PAYLOAD_CSUM_OFFSET]) {
    + err = nft_parse_u32_check(tb[NFTA_PAYLOAD_CSUM_OFFSET], U8_MAX,
    + &csum_offset);
    + if (err < 0)
    + return err;
    +
    + priv->csum_offset = csum_offset;
    + }
    if (tb[NFTA_PAYLOAD_CSUM_FLAGS]) {
    u32 flags;

    @@ -681,7 +687,7 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
    priv->csum_flags = flags;
    }

    - switch (priv->csum_type) {
    + switch (csum_type) {
    case NFT_PAYLOAD_CSUM_NONE:
    case NFT_PAYLOAD_CSUM_INET:
    break;
    @@ -695,6 +701,7 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
    default:
    return -EOPNOTSUPP;
    }
    + priv->csum_type = csum_type;

    return nft_parse_register_load(tb[NFTA_PAYLOAD_SREG], &priv->sreg,
    priv->len);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-29 13:10    [W:4.465 / U:0.268 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site