netfilter: nf_tables: validate variable length element extension

Update template to validate variable length extensions. This patch adds a new .ext_len[id] field to the template to store the expected extension length. This is used to sanity check the initialization of the variable length extension. Use PTR_ERR() in nft_set_elem_init() to report errors since, after this update, there are two reason why this might fail, either because of ENOMEM or insufficient room in the extension field (EINVAL). Kernels up until 7e6bc1f6cabc ("netfilter: nf_tables: stricter validation of element data") allowed to copy more data to the extension than was allocated. This ext_len field allows to validate if the destination has the correct size as additional check.

Pablo Neira Ayuso committed 4 years ago

Commit 34aae2c1 parent b8c3bf03 files · +73 −17Browse files

Showing the changes to include/net (1 of 3 files). Show all

Unified · Split

include/net/netfilter/nf_tables.h+3−1

@@ -651,6 +651,7 @@ extern const struct nft_set_ext_type nft_set_ext_types[]; · 650 unmodified lines
651	651	struct nft_set_ext_tmpl {
652	652	u16 len;
653	653	u8 offset[NFT_SET_EXT_NUM];
	654	+ u8 ext_len[NFT_SET_EXT_NUM];
654	655	};
655	656
656	657	/**
@@ -680,7 +681,8 @@ static inline int nft_set_ext_add_length(struct nft_set_ext_tmpl *tmpl, u8 id, · 23 unmodified lines
680	681	return -EINVAL;
681	682
682	683	tmpl->offset[id] = tmpl->len;
683		− tmpl->len += nft_set_ext_types[id].len + len;
	684	+ tmpl->ext_len[id] = nft_set_ext_types[id].len + len;
	685	+ tmpl->len += tmpl->ext_len[id];
684	686
685	687	return 0;
686	688	}