lkml.org 
[lkml]   [2022]   [Aug]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 32/86] netfilter: nft_payload: report ERANGE for too long offset and length
    Date
    From: Pablo Neira Ayuso <pablo@netfilter.org>

    [ Upstream commit 94254f990c07e9ddf1634e0b727fab821c3b5bf9 ]

    Instead of offset and length are truncation to u8, report ERANGE.

    Fixes: 96518518cc41 ("netfilter: add nftables")
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/netfilter/nft_payload.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
    index 01878c16418c2..bdb07362c0ef0 100644
    --- a/net/netfilter/nft_payload.c
    +++ b/net/netfilter/nft_payload.c
    @@ -733,6 +733,7 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
    {
    enum nft_payload_bases base;
    unsigned int offset, len;
    + int err;

    if (tb[NFTA_PAYLOAD_BASE] == NULL ||
    tb[NFTA_PAYLOAD_OFFSET] == NULL ||
    @@ -758,8 +759,13 @@ nft_payload_select_ops(const struct nft_ctx *ctx,
    if (tb[NFTA_PAYLOAD_DREG] == NULL)
    return ERR_PTR(-EINVAL);

    - offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
    - len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
    + err = nft_parse_u32_check(tb[NFTA_PAYLOAD_OFFSET], U8_MAX, &offset);
    + if (err < 0)
    + return ERR_PTR(err);
    +
    + err = nft_parse_u32_check(tb[NFTA_PAYLOAD_LEN], U8_MAX, &len);
    + if (err < 0)
    + return ERR_PTR(err);

    if (len <= 4 && is_power_of_2(len) && IS_ALIGNED(offset, len) &&
    base != NFT_PAYLOAD_LL_HEADER)
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-29 13:22    [W:4.058 / U:1.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site