From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 7 Jun 2019 14:37:30 +0000 (+0200)
Subject: netfilter: xt_owner: bail out with EINVAL in case of unsupported flags
X-Git-Tag: submit/tizen/20190705.061120~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=757f9183652ee6738ce1476db11595775f2ae251;p=profile%2Fwearable%2Fplatform%2Fkernel%2Flinux-3.18-exynos7270.git

netfilter: xt_owner: bail out with EINVAL in case of unsupported flags

Reject flags that are not supported with EINVAL.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

[sw0312.kim: backport from mainline to apply supplementary groups on netfilter]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

Change-Id: I2ab809e6b7e3823e3fd3af053348dac9af009cca
---

diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h
index e7731dcc51f..e5c670da246 100644
--- a/include/uapi/linux/netfilter/xt_owner.h
+++ b/include/uapi/linux/netfilter/xt_owner.h
@@ -10,6 +10,11 @@ enum {
 	XT_OWNER_SUPPL_GROUPS = 1 << 3,
 };
 
+#define XT_OWNER_MASK	(XT_OWNER_UID | 	\
+			 XT_OWNER_GID | 	\
+			 XT_OWNER_SOCKET |	\
+			 XT_OWNER_SUPPL_GROUPS)
+
 struct xt_owner_match_info {
 	__u32 uid_min, uid_max;
 	__u32 gid_min, gid_max;
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 5b21999a5b5..2289544b160 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -21,6 +21,9 @@ static int owner_check(const struct xt_mtchk_param *par)
 {
 	struct xt_owner_match_info *info = par->matchinfo;
 
+	if (info->match & ~XT_OWNER_MASK)
+		return -EINVAL;
+
 	/* For now only allow adding matches from the initial user namespace */
 	if ((info->match & (XT_OWNER_UID|XT_OWNER_GID)) &&
 	    (current_user_ns() != &init_user_ns))