netfilter: nft_hash: validate maximum value of u32 netlink hash attribute (abd66e9f) · Commits · 戴 / test

Use the function nft_parse_u32_check() to fetch the value and validate the u32 attribute into the hash len u8 field. This patch revisits ("netfilter: nft_exthdr: Add size check on u8 nft_exthdr attributes"). Fixes: ("netfilter: nf_tables: add hash expression") Signed-off-by:

Laura Garcia Liebana <nevola@gmail.com> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/nft_hash.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -53,6 +53,7 @@ static int nft_hash_init(const struct nft_ctx *ctx,
		{
		struct nft_hash *priv = nft_expr_priv(expr);
		u32 len;
		int err;

		if (!tb[NFTA_HASH_SREG] \|\|
		!tb[NFTA_HASH_DREG] \|\|
		@@ -67,8 +68,10 @@ static int nft_hash_init(const struct nft_ctx *ctx,
		priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]);
		priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);

		len = ntohl(nla_get_be32(tb[NFTA_HASH_LEN]));
		if (len == 0 \|\| len > U8_MAX)
		err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
		if (err < 0)
		return err;
		if (len == 0)
		return -ERANGE;

		priv->len = len;

Admin message