Skip to content

Commit 7931d32

Browse files
committed
netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This only requires a new helper function to infer the register type from the set datatype so this conditional check can be removed. Otherwise, pointer to chain object can be leaked through the registers. Fixes: 9651851 ("netfilter: add nftables") Reported-by: Linus Torvalds <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent aef5daa commit 7931d32

File tree

3 files changed

+11
-5
lines changed

3 files changed

+11
-5
lines changed

include/net/netfilter/nf_tables.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -619,6 +619,11 @@ static inline void *nft_set_priv(const struct nft_set *set)
619619
return (void *)set->data;
620620
}
621621

622+
static inline enum nft_data_types nft_set_datatype(const struct nft_set *set)
623+
{
624+
return set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE;
625+
}
626+
622627
static inline bool nft_set_gc_is_pending(const struct nft_set *s)
623628
{
624629
return refcount_read(&s->refs) != 1;

net/netfilter/nf_tables_api.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5740,8 +5740,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
57405740

57415741
if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) &&
57425742
nft_data_dump(skb, NFTA_SET_ELEM_DATA, nft_set_ext_data(ext),
5743-
set->dtype == NFT_DATA_VERDICT ? NFT_DATA_VERDICT : NFT_DATA_VALUE,
5744-
set->dlen) < 0)
5743+
nft_set_datatype(set), set->dlen) < 0)
57455744
goto nla_put_failure;
57465745

57475746
if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS) &&
@@ -11073,6 +11072,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx,
1107311072

1107411073
return 0;
1107511074
default:
11075+
if (type != NFT_DATA_VALUE)
11076+
return -EINVAL;
11077+
1107611078
if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE)
1107711079
return -EINVAL;
1107811080
if (len == 0)
@@ -11081,8 +11083,6 @@ static int nft_validate_register_store(const struct nft_ctx *ctx,
1108111083
sizeof_field(struct nft_regs, data))
1108211084
return -ERANGE;
1108311085

11084-
if (data != NULL && type != NFT_DATA_VALUE)
11085-
return -EINVAL;
1108611086
return 0;
1108711087
}
1108811088
}

net/netfilter/nft_lookup.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,8 @@ static int nft_lookup_init(const struct nft_ctx *ctx,
132132
return -EINVAL;
133133

134134
err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG],
135-
&priv->dreg, NULL, set->dtype,
135+
&priv->dreg, NULL,
136+
nft_set_datatype(set),
136137
set->dlen);
137138
if (err < 0)
138139
return err;

0 commit comments

Comments
 (0)