Unverified Commit 76959850 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10848 netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Hai <wanghai38@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/HU6AJX64NOEOE2NJPHRJBHGBQXZRI6BV/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAGEO4 
 
Link:https://gitee.com/openeuler/kernel/pulls/10848

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents e1298607 071c374b

include/net/netfilter/nf_tables.h

+5 −0
Original line number Diff line number Diff line
@@ -475,6 +475,11 @@ static inline void *nft_set_priv(const struct nft_set *set) 
	return (void *)set->data;

}



static inline enum nft_data_types nft_set_datatype(const struct nft_set *set)

{

	return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;

}



static inline struct nft_set *nft_set_container_of(const void *priv)

{

	return (void *)priv - offsetof(struct nft_set, data);

net/netfilter/nf_tables_api.c

+4 −4
Original line number Diff line number Diff line
@@ -4896,8 +4896,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb, 


	if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&

	    nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),

			  set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,

			  set->dlen) < 0)

			  nft_set_datatype(set), set->dlen) < 0)

		goto nla_put_failure;



	if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR) &&
@@ -8841,6 +8840,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, 


		return 0;

	default:

		if (type != NFT_DATA_VALUE)

			return -EINVAL;



		if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)

			return -EINVAL;

		if (len == 0)
@@ -8849,8 +8851,6 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, 
		    sizeof_field(struct nft_regs, data))

			return -ERANGE;



		if (data != NULL && type != NFT_DATA_VALUE)

			return -EINVAL;

		return 0;

	}

}

net/netfilter/nft_lookup.c

+2 −1
Original line number Diff line number Diff line
@@ -101,7 +101,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx, 
			return -EINVAL;



		err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG],

					       &priv->dreg, NULL, set->dtype,

					       &priv->dreg, NULL,

					       nft_set_datatype(set),

					       set->dlen);

		if (err < 0)

			return err;