netfilter: xt_owner: bail out with EINVAL in case of unsupported flags

Change-Id: Ic83f49e526d564977622f69ff907fb6d928dc161
Signed-off-by: Rahul Dadhich <r.dadhich@samsung.com>
(cherry picked from commit 97424c551a9eb8f44806da4fa6f7441c88c41f01)

diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h
index 2081761..7fcac2e 100644 (file)
--- a/include/uapi/linux/netfilter/xt_owner.h
+++ b/include/uapi/linux/netfilter/xt_owner.h
@@ -9,6 +9,11 @@ enum {
        XT_OWNER_SOCKET = 1 << 2,
 };
 
+#define XT_OWNER_MASK  (XT_OWNER_UID |         \
+                        XT_OWNER_GID |         \
+                        XT_OWNER_SOCKET |      \
+                        XT_OWNER_SUPPL_GROUPS)
+
 struct xt_owner_match_info {
        __u32 uid_min, uid_max;
        __u32 gid_min, gid_max;

diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 1302b47..127823f 100644 (file)
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -22,6 +22,9 @@ static int owner_check(const struct xt_mtchk_param *par)
 {
        struct xt_owner_match_info *info = par->matchinfo;
 
+       if (info->match & ~XT_OWNER_MASK)
+               return -EINVAL;
+
        /* For now only allow adding matches from the initial user namespace */
        if ((info->match & (XT_OWNER_UID|XT_OWNER_GID)) &&
            (current_user_ns() != &init_user_ns))