Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1733578
| From | "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH for 4.9 22/39] netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max |
| Date | 2017-09-18 02:50 +0200 |
| Message-ID | <uqSq6-72l-17@gated-at.bofh.it> (permalink) |
| References | <uqSq5-72l-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Liping Zhang <zlpnobody@gmail.com>
[ Upstream commit ae5c682113f9f94cc5e76f92cf041ee624c173ee ]
The helper->expect_class_max must be set to the total number of
expect_policy minus 1, since we will use the statement "if (class >
helper->expect_class_max)" to validate the CTA_EXPECT_CLASS attr in
ctnetlink_alloc_expect.
So for compatibility, set the helper->expect_class_max to the
NFCTH_POLICY_SET_NUM attr's value minus 1.
Also: it's invalid when the NFCTH_POLICY_SET_NUM attr's value is zero.
1. this will result "expect_policy = kzalloc(0, GFP_KERNEL);";
2. we cannot set the helper->expect_class_max to a proper value.
So if nla_get_be32(tb[NFCTH_POLICY_SET_NUM]) is zero, report -EINVAL to
the userspace.
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
net/netfilter/nfnetlink_cthelper.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 3b79f34b5095..b1fcfa08f0b4 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -161,6 +161,7 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
int i, ret;
struct nf_conntrack_expect_policy *expect_policy;
struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
+ unsigned int class_max;
ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
nfnl_cthelper_expect_policy_set);
@@ -170,19 +171,18 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
if (!tb[NFCTH_POLICY_SET_NUM])
return -EINVAL;
- helper->expect_class_max =
- ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
-
- if (helper->expect_class_max != 0 &&
- helper->expect_class_max > NF_CT_MAX_EXPECT_CLASSES)
+ class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
+ if (class_max == 0)
+ return -EINVAL;
+ if (class_max > NF_CT_MAX_EXPECT_CLASSES)
return -EOVERFLOW;
expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
- helper->expect_class_max, GFP_KERNEL);
+ class_max, GFP_KERNEL);
if (expect_policy == NULL)
return -ENOMEM;
- for (i=0; i<helper->expect_class_max; i++) {
+ for (i = 0; i < class_max; i++) {
if (!tb[NFCTH_POLICY_SET+i])
goto err;
@@ -191,6 +191,8 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
if (ret < 0)
goto err;
}
+
+ helper->expect_class_max = class_max - 1;
helper->expect_policy = expect_policy;
return 0;
err:
@@ -377,10 +379,10 @@ nfnl_cthelper_dump_policy(struct sk_buff *skb,
goto nla_put_failure;
if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
- htonl(helper->expect_class_max)))
+ htonl(helper->expect_class_max + 1)))
goto nla_put_failure;
- for (i=0; i<helper->expect_class_max; i++) {
+ for (i = 0; i < helper->expect_class_max + 1; i++) {
nest_parms2 = nla_nest_start(skb,
(NFCTH_POLICY_SET+i) | NLA_F_NESTED);
if (nest_parms2 == NULL)
--
2.11.0
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH for 4.9 18/39] iommu/exynos: Block SYSMMU while invalidating FLPD cache "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 27/39] x86/acpi: Restore the order of CPU IDs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 22/39] netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 35/39] xfs: remove kmem_zalloc_greedy "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 31/39] rds: ib: add error handle "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 24/39] nfs: make nfs4_cb_sv_ops static "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 32/39] md/raid10: submit bio directly to replacement disk "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 38/39] ARM: dts: BCM5301X: Fix memory start address "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 29/39] arm64: kasan: avoid bad virt_to_pfn() "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 39/39] tools/power turbostat: bugfix: GFXMHz column not changing "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 20/39] MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 28/39] iommu/io-pgtable-arm: Check for leaf entry before dereferencing it "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 23/39] parisc: perf: Fix potential NULL pointer dereference "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 34/39] i2c: meson: fix wrong variable usage in meson_i2c_put_data "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 36/39] ASoC: wm_adsp: Return an error on write to a disabled volatile control "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 25/39] ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 33/39] netfilter: nf_tables: set pktinfo->thoff at AH header if found "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200 [PATCH for 4.9 37/39] libata: transport: Remove circular dependency at free time "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-18 02:50 +0200
csiph-web