Skip to contentSkip to conversation

net: sched: act_ipt: check for underflow in __tcf_ipt_init()

PATCH Applied Dan Carpenter 2 participants 2 messages Sep 22, 2018 – Oct 2, 2018

Subsystems (4)
Networking Network drivers Kernel janitors Traffic control (tc)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 net: sched: act_ipt: check for underflow in __tcf_ipt_init()

If "td->u.target_size" is larger than sizeof(struct xt_entry_target) we return -EINVAL. But we don't check whether it's smaller than sizeof(struct xt_entry_target) and that could lead to an out of bounds read.

Fixes 7ba699c604ab ("[NET_SCHED]: Convert actions from rtnetlink to new netlink API")
Signed-off-by Dan Carpenter <[email protected]>

---
I haven't tested this. Please review carefully.

net/sched/act_ipt.c +1 -1
index 1efbfb10b1fc..8af6c11d2482 100644
@@ -135,7 +135,7 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
 	}
 
 	td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
-	if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) {
+	if (nla_len(tb[TCA_IPT_TARG]) != td->u.target_size) {
 		if (exists)
 			tcf_idr_release(*a, bind);
 		else
maintainer Applied
#1 lore raw

From: Dan Carpenter <[email protected]>
Date: Sat, 22 Sep 2018 16:46:48 +0300

Quoted 7 lines

If "td->u.target_size" is larger than sizeof(struct xt_entry_target) we return -EINVAL. But we don't check whether it's smaller than sizeof(struct xt_entry_target) and that could lead to an out of bounds read.

Fixes 7ba699c604ab ("[NET_SCHED]: Convert actions from rtnetlink to new netlink API")
Signed-off-by Dan Carpenter <[email protected]>

Applied.