mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
commit9332d27d79
upstream. This WARN can trigger because some of the names fed to the module autoload function can be of arbitrary length. Remove the WARN and add limits for all NLA_STRING attributes. Reported-by: syzbot+0e63ae76d117ae1c3a01@syzkaller.appspotmail.com Fixes:452238e8d5
("netfilter: nf_tables: add and use helper for module autoload") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
9da572424b
commit
ba8d5b1938
1 changed files with 9 additions and 4 deletions
|
@ -22,6 +22,8 @@
|
|||
#include <net/net_namespace.h>
|
||||
#include <net/sock.h>
|
||||
|
||||
#define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))
|
||||
|
||||
static LIST_HEAD(nf_tables_expressions);
|
||||
static LIST_HEAD(nf_tables_objects);
|
||||
static LIST_HEAD(nf_tables_flowtables);
|
||||
|
@ -521,7 +523,7 @@ static void nft_request_module(struct net *net, const char *fmt, ...)
|
|||
va_start(args, fmt);
|
||||
ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
|
||||
va_end(args);
|
||||
if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))
|
||||
if (ret >= MODULE_NAME_LEN)
|
||||
return;
|
||||
|
||||
mutex_unlock(&net->nft.commit_mutex);
|
||||
|
@ -1174,7 +1176,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = {
|
|||
.len = NFT_CHAIN_MAXNAMELEN - 1 },
|
||||
[NFTA_CHAIN_HOOK] = { .type = NLA_NESTED },
|
||||
[NFTA_CHAIN_POLICY] = { .type = NLA_U32 },
|
||||
[NFTA_CHAIN_TYPE] = { .type = NLA_STRING },
|
||||
[NFTA_CHAIN_TYPE] = { .type = NLA_STRING,
|
||||
.len = NFT_MODULE_AUTOLOAD_LIMIT },
|
||||
[NFTA_CHAIN_COUNTERS] = { .type = NLA_NESTED },
|
||||
[NFTA_CHAIN_FLAGS] = { .type = NLA_U32 },
|
||||
};
|
||||
|
@ -2088,7 +2091,8 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,
|
|||
}
|
||||
|
||||
static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {
|
||||
[NFTA_EXPR_NAME] = { .type = NLA_STRING },
|
||||
[NFTA_EXPR_NAME] = { .type = NLA_STRING,
|
||||
.len = NFT_MODULE_AUTOLOAD_LIMIT },
|
||||
[NFTA_EXPR_DATA] = { .type = NLA_NESTED },
|
||||
};
|
||||
|
||||
|
@ -3931,7 +3935,8 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = {
|
|||
[NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY,
|
||||
.len = NFT_USERDATA_MAXLEN },
|
||||
[NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED },
|
||||
[NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING },
|
||||
[NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING,
|
||||
.len = NFT_OBJ_MAXNAMELEN - 1 },
|
||||
};
|
||||
|
||||
static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {
|
||||
|
|
Loading…
Reference in a new issue