Commit 1e98ffea authored by Dmitry Vyukov's avatar Dmitry Vyukov Committed by Pablo Neira Ayuso
Browse files

netfilter: x_tables: fix pointer leaks to userspace 



Several netfilter matches and targets put kernel pointers into
info objects, but don't set usersize in descriptors.
This leads to kernel pointer leaks if a match/target is set
and then read back to userspace.

Properly set usersize for these matches/targets.

Found with manual code inspection.

Fixes: ec231890 ("xtables: extend matches and targets with .usersize")
Signed-off-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 0b8d9073

net/netfilter/xt_IDLETIMER.c

+1 −0
Original line number Diff line number Diff line
@@ -252,6 +252,7 @@ static struct xt_target idletimer_tg __read_mostly = { 
	.family		= NFPROTO_UNSPEC,

	.target		= idletimer_tg_target,

	.targetsize     = sizeof(struct idletimer_tg_info),

	.usersize	= offsetof(struct idletimer_tg_info, timer),

	.checkentry	= idletimer_tg_checkentry,

	.destroy        = idletimer_tg_destroy,

	.me		= THIS_MODULE,

net/netfilter/xt_LED.c

+1 −0
Original line number Diff line number Diff line
@@ -198,6 +198,7 @@ static struct xt_target led_tg_reg __read_mostly = { 
	.family		= NFPROTO_UNSPEC,

	.target		= led_tg,

	.targetsize	= sizeof(struct xt_led_info),

	.usersize	= offsetof(struct xt_led_info, internal_data),

	.checkentry	= led_tg_check,

	.destroy	= led_tg_destroy,

	.me		= THIS_MODULE,

net/netfilter/xt_limit.c

+1 −2
Original line number Diff line number Diff line
@@ -193,9 +193,8 @@ static struct xt_match limit_mt_reg __read_mostly = { 
	.compatsize       = sizeof(struct compat_xt_rateinfo),

	.compat_from_user = limit_mt_compat_from_user,

	.compat_to_user   = limit_mt_compat_to_user,

#else

	.usersize         = offsetof(struct xt_rateinfo, prev),

#endif

	.usersize         = offsetof(struct xt_rateinfo, prev),

	.me               = THIS_MODULE,

};

net/netfilter/xt_nfacct.c

+1 −0
Original line number Diff line number Diff line
@@ -62,6 +62,7 @@ static struct xt_match nfacct_mt_reg __read_mostly = { 
	.match      = nfacct_mt,

	.destroy    = nfacct_mt_destroy,

	.matchsize  = sizeof(struct xt_nfacct_match_info),

	.usersize   = offsetof(struct xt_nfacct_match_info, nfacct),

	.me         = THIS_MODULE,

};

net/netfilter/xt_statistic.c

+1 −0
Original line number Diff line number Diff line
@@ -84,6 +84,7 @@ static struct xt_match xt_statistic_mt_reg __read_mostly = { 
	.checkentry = statistic_mt_check,

	.destroy    = statistic_mt_destroy,

	.matchsize  = sizeof(struct xt_statistic_info),

	.usersize   = offsetof(struct xt_statistic_info, master),

	.me         = THIS_MODULE,

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE