Commit b29c457a authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: x_tables: fix compat match/target pad out-of-bound write

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
Reported-by: default avatarAndy Nguyen <theflow@google.com>
Fixes: 9fa492cd ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d163a925
...@@ -1193,6 +1193,8 @@ static int translate_compat_table(struct net *net, ...@@ -1193,6 +1193,8 @@ static int translate_compat_table(struct net *net,
if (!newinfo) if (!newinfo)
goto out_unlock; goto out_unlock;
memset(newinfo->entries, 0, size);
newinfo->number = compatr->num_entries; newinfo->number = compatr->num_entries;
for (i = 0; i < NF_ARP_NUMHOOKS; i++) { for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
newinfo->hook_entry[i] = compatr->hook_entry[i]; newinfo->hook_entry[i] = compatr->hook_entry[i];
......
...@@ -1428,6 +1428,8 @@ translate_compat_table(struct net *net, ...@@ -1428,6 +1428,8 @@ translate_compat_table(struct net *net,
if (!newinfo) if (!newinfo)
goto out_unlock; goto out_unlock;
memset(newinfo->entries, 0, size);
newinfo->number = compatr->num_entries; newinfo->number = compatr->num_entries;
for (i = 0; i < NF_INET_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
newinfo->hook_entry[i] = compatr->hook_entry[i]; newinfo->hook_entry[i] = compatr->hook_entry[i];
......
...@@ -1443,6 +1443,8 @@ translate_compat_table(struct net *net, ...@@ -1443,6 +1443,8 @@ translate_compat_table(struct net *net,
if (!newinfo) if (!newinfo)
goto out_unlock; goto out_unlock;
memset(newinfo->entries, 0, size);
newinfo->number = compatr->num_entries; newinfo->number = compatr->num_entries;
for (i = 0; i < NF_INET_NUMHOOKS; i++) { for (i = 0; i < NF_INET_NUMHOOKS; i++) {
newinfo->hook_entry[i] = compatr->hook_entry[i]; newinfo->hook_entry[i] = compatr->hook_entry[i];
......
...@@ -733,7 +733,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, ...@@ -733,7 +733,7 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
{ {
const struct xt_match *match = m->u.kernel.match; const struct xt_match *match = m->u.kernel.match;
struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m; struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
int pad, off = xt_compat_match_offset(match); int off = xt_compat_match_offset(match);
u_int16_t msize = cm->u.user.match_size; u_int16_t msize = cm->u.user.match_size;
char name[sizeof(m->u.user.name)]; char name[sizeof(m->u.user.name)];
...@@ -743,9 +743,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr, ...@@ -743,9 +743,6 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
match->compat_from_user(m->data, cm->data); match->compat_from_user(m->data, cm->data);
else else
memcpy(m->data, cm->data, msize - sizeof(*cm)); memcpy(m->data, cm->data, msize - sizeof(*cm));
pad = XT_ALIGN(match->matchsize) - match->matchsize;
if (pad > 0)
memset(m->data + match->matchsize, 0, pad);
msize += off; msize += off;
m->u.user.match_size = msize; m->u.user.match_size = msize;
...@@ -1116,7 +1113,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, ...@@ -1116,7 +1113,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
{ {
const struct xt_target *target = t->u.kernel.target; const struct xt_target *target = t->u.kernel.target;
struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t; struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
int pad, off = xt_compat_target_offset(target); int off = xt_compat_target_offset(target);
u_int16_t tsize = ct->u.user.target_size; u_int16_t tsize = ct->u.user.target_size;
char name[sizeof(t->u.user.name)]; char name[sizeof(t->u.user.name)];
...@@ -1126,9 +1123,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr, ...@@ -1126,9 +1123,6 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
target->compat_from_user(t->data, ct->data); target->compat_from_user(t->data, ct->data);
else else
memcpy(t->data, ct->data, tsize - sizeof(*ct)); memcpy(t->data, ct->data, tsize - sizeof(*ct));
pad = XT_ALIGN(target->targetsize) - target->targetsize;
if (pad > 0)
memset(t->data + target->targetsize, 0, pad);
tsize += off; tsize += off;
t->u.user.target_size = tsize; t->u.user.target_size = tsize;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment