From: Pablo Neira Ayuso Date: Sun, 14 Jan 2024 22:53:39 +0000 (+0100) Subject: netfilter: nf_tables: do not allow mismatch field size and set key length X-Git-Tag: v6.6.14~21 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=dc45bb00e66a33de1abb29e3d587880e1d4d9a7e;p=platform%2Fkernel%2Flinux-starfive.git netfilter: nf_tables: do not allow mismatch field size and set key length [ Upstream commit 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 ] The set description provides the size of each field in the set whose sum should not mismatch the set key length, bail out otherwise. I did not manage to crash nft_set_pipapo with mismatch fields and set key length so far, but this is UB which must be disallowed. Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 55cd821..5730f9a 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4753,8 +4753,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, static int nft_set_desc_concat(struct nft_set_desc *desc, const struct nlattr *nla) { + u32 num_regs = 0, key_num_regs = 0; struct nlattr *attr; - u32 num_regs = 0; int rem, err, i; nla_for_each_nested(attr, nla, rem) { @@ -4769,6 +4769,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, for (i = 0; i < desc->field_count; i++) num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); + key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); + if (key_num_regs != num_regs) + return -EINVAL; + if (num_regs > NFT_REG32_COUNT) return -E2BIG;