leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c8d70a700a
linux/net
History
Florian Westphal c8d70a700a netfilter: bridge: ebt_among: add more missing match size checks 
ebt_among is special, it has a dynamic match size and is exempt
from the central size checks.

commit c4585a2823 ("bridge: ebt_among: add missing match size checks")
added validation for pool size, but missed fact that the macros
ebt_among_wh_src/dst can already return out-of-bound result because
they do not check value of wh_src/dst_ofs (an offset) vs. the size
of the match that userspace gave to us.

v2:
check that offset has correct alignment.
Paolo Abeni points out that we should also check that src/dst
wormhash arrays do not overlap, and src + length lines up with
start of dst (or vice versa).
v3: compact wormhash_sizes_valid() part

NB: Fixes tag is intentionally wrong, this bug exists from day
one when match was added for 2.6 kernel. Tag is there so stable
maintainers will notice this one too.

Tested with same rules from the earlier patch.

Fixes: c4585a2823 ("bridge: ebt_among: add missing match size checks")
Reported-by: <syzbot+bdabab6f1983a03fc009@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2018-03-11 21:24:49 +01:00
..
6lowpan
9p virtio: bugfixes 2018-02-15 14:29:27 -08:00
802 treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
8021q net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
appletalk net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
atm vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
ax25 net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
batman-adv batman-adv: Fix internal interface indices types 2018-02-25 20:19:34 +01:00
bluetooth vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
bpf bpf: fix null pointer deref in bpf_prog_test_run_xdp 2018-02-01 07:43:56 -08:00
bridge netfilter: bridge: ebt_among: add more missing match size checks 2018-03-11 21:24:49 +01:00
caif vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
can can: migrate documentation to restructured text 2018-01-26 10:46:44 +01:00
ceph libceph, ceph: avoid memory leak when specifying same option several times 2018-02-26 16:19:30 +01:00
core net: make skb_gso_*_seglen functions private 2018-03-04 17:49:17 -05:00
dcb
dccp vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
decnet dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock 2018-02-16 15:46:15 -05:00
dns_resolver afs: Support the AFS dynamic root 2018-02-06 14:43:37 +00:00
dsa net: dsa: Support internal phy on 'cpu' port 2018-01-23 19:22:38 -05:00
ethernet
hsr
ieee802154
ife
ipv4 net: xfrm: use skb_gso_validate_network_len() to check gso sizes 2018-03-04 17:49:17 -05:00
ipv6 net: xfrm: use skb_gso_validate_network_len() to check gso sizes 2018-03-04 17:49:17 -05:00
iucv vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
kcm vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
key af_key: Fix memory leak in key_notify_policy. 2018-01-10 09:45:11 +01:00
l2tp l2tp: fix tunnel lookup use-after-free race 2018-02-26 12:20:37 -05:00
l3mdev
lapb treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts 2017-11-21 16:35:54 -08:00
llc net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
mac80211 mac80211: drop frames with unexpected DS bits from fast-rx to slow path 2018-02-23 12:13:17 +01:00
mac802154
mpls net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len 2018-03-04 17:49:17 -05:00
ncsi net/ncsi: Don't take any action on HNCDSC AEN 2017-12-18 14:50:11 -05:00
netfilter netfilter: x_tables: add and use xt_check_proc_name 2018-03-11 21:24:29 +01:00
netlabel net/netlabel: Add list_next_rcu() in rcu_dereference(). 2017-11-18 10:32:41 +09:00
netlink netlink: put module reference if dump start fails 2018-02-22 14:01:38 -05:00
netrom net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
nfc NFC: llcp: Limit size of SDP URI 2018-02-16 15:16:05 -05:00
nsh
openvswitch openvswitch: Remove padding from packet before L3+ conntrack processing 2018-02-01 09:46:22 -05:00
packet vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
phonet vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
psample
qrtr qrtr: add MODULE_ALIAS macro to smd 2018-02-26 15:07:04 -05:00
rds rds: Incorrect reference counting in TCP socket creation 2018-03-02 09:40:27 -05:00
rfkill vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
rose net: delete /proc THIS_MODULE references 2018-01-16 15:01:33 -05:00
rxrpc rxrpc: Fix send in rxrpc_send_data_packet() 2018-02-22 15:37:47 -05:00
sched net: sched: tbf: handle GSO_BY_FRAGS case in enqueue 2018-03-04 17:49:17 -05:00
sctp sctp: remove the left unnecessary check for chunk in sctp_renege_events 2018-02-16 16:32:37 -05:00
smc net/smc: fix NULL pointer dereference on sock_create_kern() error path 2018-02-28 12:30:25 -05:00
strparser strparser: Call sock_owned_by_user_nocheck 2017-12-28 14:28:22 -05:00
sunrpc vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
switchdev
tipc tipc: correct initial value for group congestion flag 2018-02-27 11:46:03 -05:00
tls tls: Use correct sk->sk_prot for IPV6 2018-02-27 14:41:48 -05:00
unix net: af_unix: fix typo in UNIX_SKB_FRAGS_SZ comment 2018-02-13 12:21:45 -05:00
vmw_vsock vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
wimax
wireless cfg80211: add missing dependency to CFG80211 suboptions 2018-02-27 10:54:12 +01:00
x25 treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts 2017-11-21 16:35:54 -08:00
xfrm net: rename skb_gso_validate_mtu -> skb_gso_validate_network_len 2018-03-04 17:49:17 -05:00
compat.c
Kconfig Staging/IIO patches for 4.16-rc1 2018-02-01 09:51:57 -08:00
Makefile ipx: move Novell IPX protocol support into staging 2017-11-28 13:55:00 +01:00
socket.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-01-31 14:31:10 -08:00
sysctl_net.c