lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netfilter: nf_queue: reject NF_STOLEN verdicts from userspace

Browse Source 
A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak.

This problem was previously fixed via
64507fdbc2 (netfilter:
nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because
NF_STOLEN can also be returned by a netfilter hook when iterating the
rules in nf_reinject.

Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw.

This is complementary to commit fad5444043
(netfilter: avoid double free in nf_reinject).

Cc: Julian Anastasov <ja@ssi.bg>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
Florian Westphal
2011-08-30 15:01:20 +02:00
committed by Patrick McHardy
parent 9823d9ff48
commit c6675233f9
3 changed files with 10 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
net/ipv4/netfilter/ip_queue.c
View File

@@ -314,7 +314,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
{ {
struct nf_queue_entry *entry; struct nf_queue_entry *entry;
if (vmsg->value > NF_MAX_VERDICT) if (vmsg->value > NF_MAX_VERDICT || vmsg->value == NF_STOLEN)
return -EINVAL; return -EINVAL;
entry = ipq_find_dequeue_entry(vmsg->id); entry = ipq_find_dequeue_entry(vmsg->id);
@@ -359,12 +359,9 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
break; break;
case IPQM_VERDICT: case IPQM_VERDICT:
if (pmsg->msg.verdict.value > NF_MAX_VERDICT) status = ipq_set_verdict(&pmsg->msg.verdict,
status = -EINVAL; len - sizeof(*pmsg));
else break;
status = ipq_set_verdict(&pmsg->msg.verdict,
len - sizeof(*pmsg));
break;
default: default:
status = -EINVAL; status = -EINVAL;
} }

11
net/ipv6/netfilter/ip6_queue.c
View File

@@ -314,7 +314,7 @@ ipq_set_verdict(struct ipq_verdict_msg *vmsg, unsigned int len)
{ {
struct nf_queue_entry *entry; struct nf_queue_entry *entry;
if (vmsg->value > NF_MAX_VERDICT) if (vmsg->value > NF_MAX_VERDICT || vmsg->value == NF_STOLEN)
return -EINVAL; return -EINVAL;
entry = ipq_find_dequeue_entry(vmsg->id); entry = ipq_find_dequeue_entry(vmsg->id);
@@ -359,12 +359,9 @@ ipq_receive_peer(struct ipq_peer_msg *pmsg,
break; break;
case IPQM_VERDICT: case IPQM_VERDICT:
if (pmsg->msg.verdict.value > NF_MAX_VERDICT) status = ipq_set_verdict(&pmsg->msg.verdict,
status = -EINVAL; len - sizeof(*pmsg));
else break;
status = ipq_set_verdict(&pmsg->msg.verdict,
len - sizeof(*pmsg));
break;
default: default:
status = -EINVAL; status = -EINVAL;
} }

4
net/netfilter/nfnetlink_queue.c
View File

@@ -646,8 +646,8 @@ verdicthdr_get(const struct nlattr * const nfqa[])
return NULL; return NULL;
vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]); vhdr = nla_data(nfqa[NFQA_VERDICT_HDR]);
verdict = ntohl(vhdr->verdict); verdict = ntohl(vhdr->verdict) & NF_VERDICT_MASK;
if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT) if (verdict > NF_MAX_VERDICT || verdict == NF_STOLEN)
return NULL; return NULL;
return vhdr; return vhdr;
} }