From patchwork Sun Mar 21 21:50:24 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Morris X-Patchwork-Id: 48237 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 7C027B7CF8 for ; Mon, 22 Mar 2010 08:50:29 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753401Ab0CUVuZ (ORCPT ); Sun, 21 Mar 2010 17:50:25 -0400 Received: from tundra.namei.org ([65.99.196.166]:34220 "EHLO tundra.namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753168Ab0CUVuY (ORCPT ); Sun, 21 Mar 2010 17:50:24 -0400 Received: from localhost (localhost [127.0.0.1]) by tundra.namei.org (8.13.1/8.13.1) with ESMTP id o2LLoOw9003428 for ; Sun, 21 Mar 2010 17:50:24 -0400 Date: Mon, 22 Mar 2010 08:50:24 +1100 (EST) From: James Morris To: netdev@vger.kernel.org Subject: [PATCH] Netfilter: Fix integer overflow in net/ipv6/netfilter/ip6_tables.c (fwd) Message-ID: User-Agent: Alpine 2.00 (LRH 1167 2008-08-23) MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org ---------- Forwarded message ---------- Date: Sat, 20 Mar 2010 22:32:40 +0800 From: wzt.wzt@gmail.com To: linux-kernel@vger.kernel.org Cc: netfilter-devel@vger.kernel.org, kaber@trash.net Subject: [PATCH] Netfilter: Fix integer overflow in net/ipv6/netfilter/ip6_tables.c The get.size field in the get_entries() interface is not bounded correctly. The size is used to determine the total entry size. The size is bounded, but can overflow and so the size checks may not be sufficient to catch invalid size. Fix it by catching size values that would cause overflows before calculating the size. Signed-off-by: Zhitong Wang --- net/ipv4/netfilter/ip_tables.c | 4 ++++ net/ipv6/netfilter/ip6_tables.c | 4 ++++ 2 files changed, 8 insertions(+), 0 deletions(-) diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index 4e7c719..6abd3d2 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1164,6 +1164,10 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len) } if (copy_from_user(&get, uptr, sizeof(get)) != 0) return -EFAULT; + + if (get.size >= INT_MAX / sizeof(struct ipt_get_entries)) + return -EINVAL; + if (*len != sizeof(struct ipt_get_entries) + get.size) { duprintf("get_entries: %u != %zu\n", *len, sizeof(get) + get.size); diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 0b4557e..5185822 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1190,6 +1190,10 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, int *len) } if (copy_from_user(&get, uptr, sizeof(get)) != 0) return -EFAULT; + + if (get.size >= INT_MAX / sizeof(struct ip6t_get_entries)) + return -EINVAL; + if (*len != sizeof(struct ip6t_get_entries) + get.size) { duprintf("get_entries: %u != %zu\n", *len, sizeof(get) + get.size);