netfilter: nft_payload: do not truncate csum_offset and csum_type

[ Upstream commit 7044ab281febae9e2fa9b0b247693d6026166293 ]

Instead report ERANGE if csum_offset is too long, and EOPNOTSUPP if type
is not support.

Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index da0ed34..da652c2 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -712,17 +712,23 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
                                const struct nlattr * const tb[])
 {
        struct nft_payload_set *priv = nft_expr_priv(expr);
+       u32 csum_offset, csum_type = NFT_PAYLOAD_CSUM_NONE;
+       int err;
 
        priv->base        = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
        priv->offset      = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET]));
        priv->len         = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN]));
 
        if (tb[NFTA_PAYLOAD_CSUM_TYPE])
-               priv->csum_type =
-                       ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
-       if (tb[NFTA_PAYLOAD_CSUM_OFFSET])
-               priv->csum_offset =
-                       ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_OFFSET]));
+               csum_type = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
+       if (tb[NFTA_PAYLOAD_CSUM_OFFSET]) {
+               err = nft_parse_u32_check(tb[NFTA_PAYLOAD_CSUM_OFFSET], U8_MAX,
+                                         &csum_offset);
+               if (err < 0)
+                       return err;
+
+               priv->csum_offset = csum_offset;
+       }
        if (tb[NFTA_PAYLOAD_CSUM_FLAGS]) {
                u32 flags;
 
@@ -733,7 +739,7 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
                priv->csum_flags = flags;
        }
 
-       switch (priv->csum_type) {
+       switch (csum_type) {
        case NFT_PAYLOAD_CSUM_NONE:
        case NFT_PAYLOAD_CSUM_INET:
                break;
@@ -747,6 +753,7 @@ static int nft_payload_set_init(const struct nft_ctx *ctx,
        default:
                return -EOPNOTSUPP;
        }
+       priv->csum_type = csum_type;
 
        return nft_parse_register_load(tb[NFTA_PAYLOAD_SREG], &priv->sreg,
                                       priv->len);