From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 7 Jun 2019 14:37:30 +0000 (+0200)
Subject: netfilter: xt_owner: bail out with EINVAL in case of unsupported flags
X-Git-Tag: submit/tizen/20200402.094258~94
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=bf9e81db1f39ee02df92c3ccd565a41ac30f6bd7;p=platform%2Fkernel%2Flinux-rpi.git

netfilter: xt_owner: bail out with EINVAL in case of unsupported flags

Reject flags that are not supported with EINVAL.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

[sw0312.kim: backport from mainline to apply supplementary groups on netfilter]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>

Change-Id: Id867ca48290a8e6627ad7d1b1f159669fc5c44a1
---

diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h
index 9e98c09..5108df4 100644
--- a/include/uapi/linux/netfilter/xt_owner.h
+++ b/include/uapi/linux/netfilter/xt_owner.h
@@ -11,6 +11,11 @@ enum {
 	XT_OWNER_SUPPL_GROUPS = 1 << 3,
 };
 
+#define XT_OWNER_MASK	(XT_OWNER_UID | 	\
+			 XT_OWNER_GID | 	\
+			 XT_OWNER_SOCKET |	\
+			 XT_OWNER_SUPPL_GROUPS)
+
 struct xt_owner_match_info {
 	__u32 uid_min, uid_max;
 	__u32 gid_min, gid_max;
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index a878450..ee597fd 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -25,6 +25,9 @@ static int owner_check(const struct xt_mtchk_param *par)
 	struct xt_owner_match_info *info = par->matchinfo;
 	struct net *net = par->net;
 
+	if (info->match & ~XT_OWNER_MASK)
+		return -EINVAL;
+
 	/* Only allow the common case where the userns of the writer
 	 * matches the userns of the network namespace.
 	 */