OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: ebtables: also count base chain policies 

ebtables doesn't include the base chain policies in the rule count,
so we need to add them manually when we call into the x_tables core
to allocate space for the comapt offset table.

This lead syzbot to trigger:
WARNING: CPU: 1 PID: 9012 at net/netfilter/x_tables.c:649
xt_compat_add_offset.cold+0x11/0x36 net/netfilter/x_tables.c:649

Reported-by: syzbot+276ddebab3382bbf72db@syzkaller.appspotmail.com
Fixes: 2035f3ff8e ("netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2019-07-29 17:58:10 +02:00 committed by Pablo Neira Ayuso
parent 91826ba138
commit 3b48300d5c
1 changed files with 17 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
net/bridge/netfilter/ebtables.c
View File

@ -1770,20 +1770,28 @@ static int compat_calc_entry(const struct ebt_entry *e,
return 0;
}
static int ebt_compat_init_offsets(unsigned int number)
{
if (number > INT_MAX)
return -EINVAL;
/* also count the base chain policies */
number += NF_BR_NUMHOOKS;
return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
}
static int compat_table_info(const struct ebt_table_info *info,
struct compat_ebt_replace *newinfo)
{
unsigned int size = info->entries_size;
const void *entries = info->entries;
int ret;
newinfo->entries_size = size;
if (info->nentries) {
int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
info->nentries);
if (ret)
return ret;
}
ret = ebt_compat_init_offsets(info->nentries);
if (ret)
return ret;
return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
entries, newinfo);
@ -2234,11 +2242,9 @@ static int compat_do_replace(struct net *net, void __user *user,
xt_compat_lock(NFPROTO_BRIDGE);
if (tmp.nentries) {
ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
if (ret < 0)
goto out_unlock;
}
ret = ebt_compat_init_offsets(tmp.nentries);
if (ret < 0)
goto out_unlock;
ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
if (ret < 0)