| Message ID | 20161114213331.GA13743@sonyv |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
On Mon, Nov 14, 2016 at 10:33:34PM +0100, Laura Garcia Liebana wrote: > Use the function nft_parse_u32_check() to fetch the value and validate > the u32 attribute into the hash len u8 field. > > This patch revisits 4da449ae1df9 ("netfilter: nft_exthdr: Add size check > on u8 nft_exthdr attributes"). Applied, thanks. Please, always target your fixes to nf. New features go to nf-next. Regarding patch title, in second place we usually specify to what component this is targeted to, so I would suggest: netfilter: nft_hash: validate maximum value of u32 netlink hash attribute so git log --oneline quickly tells us this is targetd to nft_hash. I have also added this tag which is useful for -stable maintainers: Fixes: cb1b69b0b15b ("netfilter: nf_tables: add hash expression") Thanks Laura! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c index 97ad8e30e4b4..eb2721af898d 100644 --- a/net/netfilter/nft_hash.c +++ b/net/netfilter/nft_hash.c @@ -53,6 +53,7 @@ static int nft_hash_init(const struct nft_ctx *ctx, { struct nft_hash *priv = nft_expr_priv(expr); u32 len; + int err; if (!tb[NFTA_HASH_SREG] || !tb[NFTA_HASH_DREG] || @@ -66,8 +67,10 @@ static int nft_hash_init(const struct nft_ctx *ctx, priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]); priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]); - len = ntohl(nla_get_be32(tb[NFTA_HASH_LEN])); - if (len == 0 || len > U8_MAX) + err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len); + if (err < 0) + return err; + if (len == 0) return -ERANGE; priv->len = len;
Use the function nft_parse_u32_check() to fetch the value and validate the u32 attribute into the hash len u8 field. This patch revisits 4da449ae1df9 ("netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes"). Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> --- net/netfilter/nft_hash.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)