mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 14:19:16 +00:00
netfilter: nf_tables: do not allow mismatch field size and set key length
[ Upstream commit3ce67e3793
] The set description provides the size of each field in the set whose sum should not mismatch the set key length, bail out otherwise. I did not manage to crash nft_set_pipapo with mismatch fields and set key length so far, but this is UB which must be disallowed. Fixes:f3a2181e16
("netfilter: nf_tables: Support for sets with multiple ranged fields") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
7ae19ee81c
commit
9cb084df01
1 changed files with 5 additions and 1 deletions
|
@ -4523,8 +4523,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr,
|
|||
static int nft_set_desc_concat(struct nft_set_desc *desc,
|
||||
const struct nlattr *nla)
|
||||
{
|
||||
u32 num_regs = 0, key_num_regs = 0;
|
||||
struct nlattr *attr;
|
||||
u32 num_regs = 0;
|
||||
int rem, err, i;
|
||||
|
||||
nla_for_each_nested(attr, nla, rem) {
|
||||
|
@ -4539,6 +4539,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc,
|
|||
for (i = 0; i < desc->field_count; i++)
|
||||
num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32));
|
||||
|
||||
key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32));
|
||||
if (key_num_regs != num_regs)
|
||||
return -EINVAL;
|
||||
|
||||
if (num_regs > NFT_REG32_COUNT)
|
||||
return -E2BIG;
|
||||
|
||||
|
|
Loading…
Reference in a new issue