From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AIpwx4/uCj0KvLYv3xa8hYZWwDQrqtv5A16tKPB3oa/XpLSM1U9w7FmHhYLCJrVL2CJB4oncelS/ ARC-Seal: i=1; a=rsa-sha256; t=1523021447; cv=none; d=google.com; s=arc-20160816; b=Z+ZOYdBgEAU+lGvia0hQrCUxZUgyPrHvQqMH8+VufHBOrav7HNyunUdmrQLlbf3jsA 8IPJvkgTEUYHyvwUCw6FCHKKum1yV1nNevInv7XidkJHyVfzHxt4EgCZe3J5wfAGIyhW aorJZzdB/XuuG1j5WLT9GF5QD33knZZ1H+TsYTvSETWYKtotgB23urankJQUkhuKFLFz WTkmNldy2AZy/bUkhY9jDL7mD20mFfhGRbiqYqZKyGi41b+BXhxgUOzmGxTmv0QM3Iy1 wvo8bzNkw4wrpmGn8hIfVV6QEsUCrDCSvWA1f+YWhuZab6REIkU83vkPCebhCHrhvF6a 5ZYw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=UMK+7xDn0S//kB43lZ+pzdkTKFEU2VVG7XmTpkDnEz4=; b=iozV/q9QTvzpoftxE/DKwBLSvGjW8QbLmpLWGY3jaPHnZmVHNjSRM1nNdoA8lZeGrz eoF6dnj853dVZoYL4xgGe7yBPz5D4J1vXHC/WuOyM836jv8fJaQerK+mtKm6CfILmgl6 iALkrVjtoGYrHVZ4Rv536pRwQwGuk/ggPz6kh5SnoYlsRLHqFKyDr3WPhf8YvDhRDzk8 EuPW9gCM6xXLL3yUYhDRTCF80OpFZqY0/Sta+ClamZ7sTxxWqaZ2Qetutuwo/aALJpMW JBPtSmzYqa0AiE0hAfUGy9SO7DY4TjZV7qzciGV+/dpys0u84xhTKX4nspk8Al9MzHF0 +1dg== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.61.202 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.61.202 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+bdabab6f1983a03fc009@syzkaller.appspotmail.com, Florian Westphal , Eric Dumazet , Pablo Neira Ayuso Subject: [PATCH 4.4 39/72] netfilter: bridge: ebt_among: add more missing match size checks Date: Fri, 6 Apr 2018 15:23:40 +0200 Message-Id: <20180406084308.406734744@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180406084305.210085169@linuxfoundation.org> References: <20180406084305.210085169@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1597003597962532229?= X-GMAIL-MSGID: =?utf-8?q?1597003737464297081?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Westphal commit c8d70a700a5b486bfa8e5a7d33d805389f6e59f9 upstream. ebt_among is special, it has a dynamic match size and is exempt from the central size checks. commit c4585a2823edf ("bridge: ebt_among: add missing match size checks") added validation for pool size, but missed fact that the macros ebt_among_wh_src/dst can already return out-of-bound result because they do not check value of wh_src/dst_ofs (an offset) vs. the size of the match that userspace gave to us. v2: check that offset has correct alignment. Paolo Abeni points out that we should also check that src/dst wormhash arrays do not overlap, and src + length lines up with start of dst (or vice versa). v3: compact wormhash_sizes_valid() part NB: Fixes tag is intentionally wrong, this bug exists from day one when match was added for 2.6 kernel. Tag is there so stable maintainers will notice this one too. Tested with same rules from the earlier patch. Fixes: c4585a2823edf ("bridge: ebt_among: add missing match size checks") Reported-by: Signed-off-by: Florian Westphal Reviewed-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/bridge/netfilter/ebt_among.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) --- a/net/bridge/netfilter/ebt_among.c +++ b/net/bridge/netfilter/ebt_among.c @@ -177,6 +177,28 @@ static bool poolsize_invalid(const struc return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple)); } +static bool wormhash_offset_invalid(int off, unsigned int len) +{ + if (off == 0) /* not present */ + return false; + + if (off < (int)sizeof(struct ebt_among_info) || + off % __alignof__(struct ebt_mac_wormhash)) + return true; + + off += sizeof(struct ebt_mac_wormhash); + + return off > len; +} + +static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b) +{ + if (a == 0) + a = sizeof(struct ebt_among_info); + + return ebt_mac_wormhash_size(wh) + a == b; +} + static int ebt_among_mt_check(const struct xt_mtchk_param *par) { const struct ebt_among_info *info = par->matchinfo; @@ -189,6 +211,10 @@ static int ebt_among_mt_check(const stru if (expected_length > em->match_size) return -EINVAL; + if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) || + wormhash_offset_invalid(info->wh_src_ofs, em->match_size)) + return -EINVAL; + wh_dst = ebt_among_wh_dst(info); if (poolsize_invalid(wh_dst)) return -EINVAL; @@ -201,6 +227,14 @@ static int ebt_among_mt_check(const stru if (poolsize_invalid(wh_src)) return -EINVAL; + if (info->wh_src_ofs < info->wh_dst_ofs) { + if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs)) + return -EINVAL; + } else { + if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs)) + return -EINVAL; + } + expected_length += ebt_mac_wormhash_size(wh_src); if (em->match_size != EBT_ALIGN(expected_length)) {