Update template to validate variable length extensions. This patch adds a new .ext_len[id] field to the template to store the expected extension length. This is used to sanity check the initialization of the variable length extension. Use PTR_ERR() in nft_set_elem_init() to report errors since, after this update, there are two reason why this might fail, either because of ENOMEM or insufficient room in the extension field (EINVAL). Kernels up until 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data") allowed to copy more data to the extension than was allocated. This ext_len field allows to validate if the destination has the correct size as additional check.
Showing the changes to include/net (1 of 3 files). Show all
Unified · Split
| @@ -651,6 +651,7 @@ extern const struct nft_set_ext_type nft_set_ext_types[]; · 650 unmodified lines | |||
| 651 | struct nft_set_ext_tmpl { | 651 | struct nft_set_ext_tmpl { |
| 652 | u16 len; | 652 | u16 len; |
| 653 | u8 offset[NFT_SET_EXT_NUM]; | 653 | u8 offset[NFT_SET_EXT_NUM]; |
| 654 | u8 ext_len[NFT_SET_EXT_NUM]; | ||
| 654 | }; | 655 | }; |
| 655 | 656 | ||
| 656 | /** | 657 | /** |
| @@ -680,7 +681,8 @@ static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, · 23 unmodified lines | |||
| 680 | return -EINVAL; | 681 | return -EINVAL; |
| 681 | 682 | ||
| 682 | tmpl->offset[id] = tmpl->len; | 683 | tmpl->offset[id] = tmpl->len; |
| 683 | tmpl->len += nft_set_ext_types[id].len + len; | 684 | tmpl->ext_len[id] = nft_set_ext_types[id].len + len; |
| 685 | tmpl->len += tmpl->ext_len[id]; | ||
| 684 | 686 | ||
| 685 | return 0; | 687 | return 0; |
| 686 | } | 688 | } |