Commit 9a8ac4d3 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by sanglipeng1
Browse files

netfilter: nf_tables: do not allow mismatch field size and set key length 

stable inclusion
from stable-v5.10.209
commit 2d4c0798a1ef8db15b3277697ac2def4eda42312
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9U3NW

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2d4c0798a1ef8db15b3277697ac2def4eda42312



--------------------------------

[ Upstream commit 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 ]

The set description provides the size of each field in the set whose sum
should not mismatch the set key length, bail out otherwise.

I did not manage to crash nft_set_pipapo with mismatch fields and set key
length so far, but this is UB which must be disallowed.

Fixes: f3a2181e ("netfilter: nf_tables: Support for sets with multiple ranged fields")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng1 <sanglipeng1@jd.com>
parent 5b91bce6

net/netfilter/nf_tables_api.c

+5 −1
Original line number Diff line number Diff line
@@ -4328,8 +4328,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, 
static int nft_set_desc_concat(struct nft_set_desc *desc,

			       const struct nlattr *nla)

{

	u32 num_regs = 0, key_num_regs = 0;

	struct nlattr *attr;

	u32 num_regs = 0;

	int rem, err, i;



	nla_for_each_nested(attr, nla, rem) {
@@ -4344,6 +4344,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, 
	for (i = 0; i < desc->field_count; i++)

		num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32));



	key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32));

	if (key_num_regs != num_regs)

		return -EINVAL;



	if (num_regs > NFT_REG32_COUNT)

		return -E2BIG;