Commit 9332d27d authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: remove WARN and add NLA_STRING upper limits 



This WARN can trigger because some of the names fed to the module
autoload function can be of arbitrary length.

Remove the WARN and add limits for all NLA_STRING attributes.

Reported-by: default avatar <syzbot+0e63ae76d117ae1c3a01@syzkaller.appspotmail.com>
Fixes: 452238e8 ("netfilter: nf_tables: add and use helper for module autoload")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 9ec22d7c

net/netfilter/nf_tables_api.c

+9 −4
Original line number Diff line number Diff line
@@ -22,6 +22,8 @@ 
#include <net/net_namespace.h>

#include <net/sock.h>



#define NFT_MODULE_AUTOLOAD_LIMIT (MODULE_NAME_LEN - sizeof("nft-expr-255-"))



static LIST_HEAD(nf_tables_expressions);

static LIST_HEAD(nf_tables_objects);

static LIST_HEAD(nf_tables_flowtables);
@@ -583,7 +585,7 @@ static void nft_request_module(struct net *net, const char *fmt, ...) 
	va_start(args, fmt);

	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);

	va_end(args);

	if (WARN(ret >= MODULE_NAME_LEN, "truncated: '%s' (len %d)", module_name, ret))

	if (ret >= MODULE_NAME_LEN)

		return;



	mutex_unlock(&net->nft.commit_mutex);
@@ -1242,7 +1244,8 @@ static const struct nla_policy nft_chain_policy[NFTA_CHAIN_MAX + 1] = { 
				    .len = NFT_CHAIN_MAXNAMELEN - 1 },

	[NFTA_CHAIN_HOOK]	= { .type = NLA_NESTED },

	[NFTA_CHAIN_POLICY]	= { .type = NLA_U32 },

	[NFTA_CHAIN_TYPE]	= { .type = NLA_STRING },

	[NFTA_CHAIN_TYPE]	= { .type = NLA_STRING,

				    .len = NFT_MODULE_AUTOLOAD_LIMIT },

	[NFTA_CHAIN_COUNTERS]	= { .type = NLA_NESTED },

	[NFTA_CHAIN_FLAGS]	= { .type = NLA_U32 },

};
@@ -2356,7 +2359,8 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net, 
}



static const struct nla_policy nft_expr_policy[NFTA_EXPR_MAX + 1] = {

	[NFTA_EXPR_NAME]	= { .type = NLA_STRING },

	[NFTA_EXPR_NAME]	= { .type = NLA_STRING,

				    .len = NFT_MODULE_AUTOLOAD_LIMIT },

	[NFTA_EXPR_DATA]	= { .type = NLA_NESTED },

};
@@ -4199,7 +4203,8 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { 
	[NFTA_SET_ELEM_USERDATA]	= { .type = NLA_BINARY,

					    .len = NFT_USERDATA_MAXLEN },

	[NFTA_SET_ELEM_EXPR]		= { .type = NLA_NESTED },

	[NFTA_SET_ELEM_OBJREF]		= { .type = NLA_STRING },

	[NFTA_SET_ELEM_OBJREF]		= { .type = NLA_STRING,

					    .len = NFT_OBJ_MAXNAMELEN - 1 },

};



static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = {

CRA Git | Maintained and supported by SUSTech CRA and CCSE