Liping Zhang fd89b23a46 netfilter: nft_set_bitmap: fetch the element key based on the set->klen ... Currently we just assume the element key as a u32 integer, regardless of the set key length. This is incorrect, for example, the tcp port number is only 16 bits. So when we use the nft_payload expr to get the tcp dport and store it to dreg, the dport will be stored at 0~15 bits, and 16~31 bits will be padded with zero. So the reg->data[dreg] will be looked like as below: 0 15 31 +-+-+-+-+-+-+-+-+-+-+-+-+ | tcp dport | 0 | +-+-+-+-+-+-+-+-+-+-+-+-+ But for these big-endian systems, if we treate this register as a u32 integer, the element key will be larger than 65535, so the following lookup in bitmap set will cause out of bound access. Another issue is that if we add element with comments in bitmap set(although the comments will be ignored eventually), the element will vanish strangely. Because we treate the element key as a u32 integer, so the comments will become the part of the element key, then the element key will also be larger than 65535 and out of bound access will happen: # nft add element t s { 1 comment test } Since set->klen is 1 or 2, it's fine to treate the element key as a u8 or u16 integer. Fixes: 665153ff57 ("netfilter: nf_tables: add bitmap set type") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2017-03-13 13:16:42 +01:00
..
6lowpan	6lowpan: use rb_entry()	2017-01-22 16:46:13 -05:00
9p	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2017-03-03 21:44:35 -08:00
802	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
8021q	net: remove ndo_neigh_{construct, destroy} from stacked devices	2017-02-06 11:25:57 -05:00
appletalk	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
atm	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
ax25	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
batman-adv	This contains just the average.h change in order to get it	2017-03-02 14:39:17 -08:00
bluetooth	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
caif	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
can	can: bcm: fix hrtimer/tasklet termination in bcm op removal	2017-01-30 11:05:04 +01:00
ceph	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
dcb
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
decnet	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
dns_resolver	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-11 02:31:11 -05:00
ethernet	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-02-16 21:25:49 -05:00
hsr	net/hsr: use eth_hw_addr_random()	2017-02-21 13:25:22 -05:00
ieee802154	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
ife	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
ipv4	netfilter: don't track fragmented packets	2017-03-08 18:02:12 +01:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
ipx	ktime: Get rid of the union	2016-12-25 17:21:22 +01:00
irda	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
iucv	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
kcm	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
key
l2tp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-28 10:00:39 -08:00
l3mdev
lapb	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
llc	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
mac802154	sched/headers: Prepare to use <linux/rcuupdate.h> instead of <linux/rculist.h> in <linux/sched.h>	2017-03-02 08:42:38 +01:00
mpls	net: mpls: Add support for netconf	2017-02-20 11:13:37 -05:00
ncsi
netfilter	netfilter: nft_set_bitmap: fetch the element key based on the set->klen	2017-03-13 13:16:42 +01:00
netlabel	netlabel: add CALIPSO to the list of built-in protocols	2017-01-06 22:20:45 -05:00
netlink	net: adjust skb->truesize in pskb_expand_head()	2017-01-27 12:03:29 -05:00
netrom	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
nfc	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
openvswitch	openvswitch: actions: fixed a brace coding style warning	2017-03-02 13:14:44 -08:00
packet	net: don't call strlen() on the user buffer in packet_bind_spkt()	2017-03-01 20:55:57 -08:00
phonet	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
psample	net: Introduce psample, a new genetlink channel for packet sampling	2017-01-24 13:44:28 -05:00
qrtr	net: qrtr: Mark 'buf' as little endian	2017-01-10 20:45:04 -05:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
rfkill	rfkill: remove rfkill-regulator	2017-01-24 11:07:35 +01:00
rose	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
sched	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/loadavg.h>	2017-03-02 08:42:27 +01:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-03-04 17:31:39 -08:00
smc	sched/headers: Move task_struct::signal and task_struct::sighand types and accessors into <linux/sched/signal.h>	2017-03-03 01:43:37 +01:00
strparser	strparser: destroy workqueue on module exit	2017-03-03 20:43:26 -08:00
sunrpc	sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>	2017-03-02 08:42:31 +01:00
switchdev
tipc	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
unix	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
vmw_vsock	Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2017-03-03 10:16:38 -08:00
wimax
wireless	Some more updates:	2017-02-10 14:31:51 -05:00
x25	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
xfrm	xfrm: provide correct dst in xfrm_neigh_lookup	2017-02-26 21:35:24 -05:00
compat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00
Kconfig	bpf: make jited programs visible in traces	2017-02-17 13:40:05 -05:00
Makefile	net: Introduce ife encapsulation module	2017-02-03 15:16:45 -05:00
socket.c	net: socket: fix recvmmsg not returning error from sock_error	2017-02-21 13:35:25 -05:00
sysctl_net.c