leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nfnetlink_cthelper: reject too large userspace allocation requests

Browse Source 
Userspace should not abuse the kernel to store large amounts of data,
reject requests larger than the private area can accommodate.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2017-04-16 01:29:16 +02:00 committed by Pablo Neira Ayuso
parent dcf67740f2
commit 157ffffeb5
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
net/netfilter/nfnetlink_cthelper.c
View File

@ -104,7 +104,7 @@ nfnl_cthelper_from_nlattr(struct nlattr *attr, struct nf_conn *ct)
if (help->helper->data_len == 0) if (help->helper->data_len == 0)
return -EINVAL; return -EINVAL;
memcpy(help->data, nla_data(attr), help->helper->data_len); nla_memcpy(help->data, nla_data(attr), sizeof(help->data));
return 0; return 0;
} }
@ -216,6 +216,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
{ {
struct nf_conntrack_helper *helper; struct nf_conntrack_helper *helper;
struct nfnl_cthelper *nfcth; struct nfnl_cthelper *nfcth;
unsigned int size;
int ret; int ret;
if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN]) if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN])
@ -231,7 +232,12 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
goto err1; goto err1;
strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN); strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
helper->data_len = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
ret = -ENOMEM;
goto err2;
}
helper->flags |= NF_CT_HELPER_F_USERSPACE; helper->flags |= NF_CT_HELPER_F_USERSPACE;
memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple)); memcpy(&helper->tuple, tuple, sizeof(struct nf_conntrack_tuple));