From patchwork Tue Jul 19 11:07:16 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Kubecek X-Patchwork-Id: 650120 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3rty1R6pYSz9sBX for ; Tue, 19 Jul 2016 21:07:23 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753165AbcGSLHV (ORCPT ); Tue, 19 Jul 2016 07:07:21 -0400 Received: from mx2.suse.de ([195.135.220.15]:45010 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753061AbcGSLHT (ORCPT ); Tue, 19 Jul 2016 07:07:19 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 11911AD44; Tue, 19 Jul 2016 11:07:17 +0000 (UTC) Received: by unicorn.suse.cz (Postfix, from userid 1000) id C5910A0EB7; Tue, 19 Jul 2016 13:07:16 +0200 (CEST) In-Reply-To: <20160719063308.EDD42A0B22@unicorn.suse.cz> References: <20160719063308.EDD42A0B22@unicorn.suse.cz> From: Michal Kubecek Subject: [PATCH stable-4.1 v2] netfilter: x_tables: fix stable backport To: Sasha Levin Cc: stable@vger.kernel.org, netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, Florian Westphal , Takashi Iwai Message-Id: <20160719110716.C5910A0EB7@unicorn.suse.cz> Date: Tue, 19 Jul 2016 13:07:16 +0200 (CEST) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Stable-4.1 backport of mainline commit 364723410175 ("netfilter: x_tables: validate targets of jumps") doesn't handle correctly the fact that 4.1 kernel is missing commit 482cfc318559 ("netfilter: xtables: avoid percpu ruleset duplication") so that t->entries is still a per-cpu array in find_jump_target(). Use the same fix as e.g. stable-3.14 backport. Fixes: 8163327a3a92 ("netfilter: x_tables: validate targets of jumps") Signed-off-by: Michal Kubecek --- net/ipv4/netfilter/arp_tables.c | 5 +++-- net/ipv4/netfilter/ip_tables.c | 5 +++-- net/ipv6/netfilter/ip6_tables.c | 5 +++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c index 2953ee9e5fa0..49e145640ee7 100644 --- a/net/ipv4/netfilter/arp_tables.c +++ b/net/ipv4/netfilter/arp_tables.c @@ -363,11 +363,12 @@ static inline bool unconditional(const struct arpt_entry *e) } static bool find_jump_target(const struct xt_table_info *t, + const void *entry0, const struct arpt_entry *target) { struct arpt_entry *iter; - xt_entry_foreach(iter, t->entries, t->size) { + xt_entry_foreach(iter, entry0, t->size) { if (iter == target) return true; } @@ -469,7 +470,7 @@ static int mark_source_chains(const struct xt_table_info *newinfo, pos, newpos); e = (struct arpt_entry *) (entry0 + newpos); - if (!find_jump_target(newinfo, e)) + if (!find_jump_target(newinfo, entry0, e)) return 0; } else { /* ... this is a fallthru */ diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index 3bcf28bf1525..52a883645899 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -439,11 +439,12 @@ ipt_do_table(struct sk_buff *skb, } static bool find_jump_target(const struct xt_table_info *t, + const void *entry0, const struct ipt_entry *target) { struct ipt_entry *iter; - xt_entry_foreach(iter, t->entries, t->size) { + xt_entry_foreach(iter, entry0, t->size) { if (iter == target) return true; } @@ -549,7 +550,7 @@ mark_source_chains(const struct xt_table_info *newinfo, pos, newpos); e = (struct ipt_entry *) (entry0 + newpos); - if (!find_jump_target(newinfo, e)) + if (!find_jump_target(newinfo, entry0, e)) return 0; } else { /* ... this is a fallthru */ diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 5254d76dfce8..b77bf6dab70c 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -452,11 +452,12 @@ ip6t_do_table(struct sk_buff *skb, } static bool find_jump_target(const struct xt_table_info *t, + const void *entry0, const struct ip6t_entry *target) { struct ip6t_entry *iter; - xt_entry_foreach(iter, t->entries, t->size) { + xt_entry_foreach(iter, entry0, t->size) { if (iter == target) return true; } @@ -562,7 +563,7 @@ mark_source_chains(const struct xt_table_info *newinfo, pos, newpos); e = (struct ip6t_entry *) (entry0 + newpos); - if (!find_jump_target(newinfo, e)) + if (!find_jump_target(newinfo, entry0, e)) return 0; } else { /* ... this is a fallthru */