From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Pablo Neira Ayuso <pablo@netfilter.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 13/62] netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
Date: Sat, 11 Jan 2020 10:49:55 +0100 [thread overview]
Message-ID: <20200111094842.726629076@linuxfoundation.org> (raw)
In-Reply-To: <20200111094837.425430968@linuxfoundation.org>
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit bffc124b6fe37d0ae9b428d104efb426403bb5c9 ]
Only NFTA_SET_ELEM_KEY and NFTA_SET_ELEM_FLAGS make sense for elements
whose NFT_SET_ELEM_INTERVAL_END flag is set on.
Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 7ef126489d4e..91490446ebb4 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3917,14 +3917,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
if (nla[NFTA_SET_ELEM_DATA] == NULL &&
!(flags & NFT_SET_ELEM_INTERVAL_END))
return -EINVAL;
- if (nla[NFTA_SET_ELEM_DATA] != NULL &&
- flags & NFT_SET_ELEM_INTERVAL_END)
- return -EINVAL;
} else {
if (nla[NFTA_SET_ELEM_DATA] != NULL)
return -EINVAL;
}
+ if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
+ (nla[NFTA_SET_ELEM_DATA] ||
+ nla[NFTA_SET_ELEM_OBJREF] ||
+ nla[NFTA_SET_ELEM_TIMEOUT] ||
+ nla[NFTA_SET_ELEM_EXPIRATION] ||
+ nla[NFTA_SET_ELEM_USERDATA] ||
+ nla[NFTA_SET_ELEM_EXPR]))
+ return -EINVAL;
+
timeout = 0;
if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
if (!(set->flags & NFT_SET_TIMEOUT))
--
2.20.1
next prev parent reply other threads:[~2020-01-11 10:09 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-11 9:49 [PATCH 4.14 00/62] 4.14.164-stable review Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 01/62] USB: dummy-hcd: use usb_urb_dir_in instead of usb_pipein Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 02/62] USB: dummy-hcd: increase max number of devices to 32 Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 03/62] locking/spinlock/debug: Fix various data races Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 04/62] netfilter: ctnetlink: netns exit must wait for callbacks Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 05/62] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 06/62] libtraceevent: Fix lib installation with O= Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 07/62] x86/efi: Update e820 with reserved EFI boot services data to fix kexec breakage Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 08/62] efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 09/62] efi/gop: Return EFI_SUCCESS if a usable GOP was found Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 10/62] efi/gop: Fix memory leak in __gop_query32/64() Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 11/62] ARM: vexpress: Set-up shared OPP table instead of individual for each CPU Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 12/62] netfilter: uapi: Avoid undefined left-shift in xt_sctp.h Greg Kroah-Hartman
2020-01-11 9:49 ` Greg Kroah-Hartman [this message]
2020-01-11 9:49 ` [PATCH 4.14 14/62] ARM: dts: Cygnus: Fix MDIO node address/size cells Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 15/62] spi: spi-cavium-thunderx: Add missing pci_release_regions() Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 16/62] ASoC: topology: Check return value for soc_tplg_pcm_create() Greg Kroah-Hartman
2020-01-11 9:49 ` [PATCH 4.14 17/62] ARM: dts: bcm283x: Fix critical trip point Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 18/62] bpf, mips: Limit to 33 tail calls Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 19/62] ARM: dts: am437x-gp/epos-evm: fix panel compatible Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 20/62] samples: bpf: Replace symbol compare of trace_event Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 21/62] samples: bpf: fix syscall_tp due to unused syscall Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 22/62] powerpc: Ensure that swiotlb buffer is allocated from low memory Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 23/62] bnx2x: Do not handle requests from VFs after parity Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 24/62] bnx2x: Fix logic to get total no. of PFs per engine Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 25/62] net: usb: lan78xx: Fix error message format specifier Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 26/62] rfkill: Fix incorrect check to avoid NULL pointer dereference Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 27/62] ASoC: wm8962: fix lambda value Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 28/62] regulator: rn5t618: fix module aliases Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 29/62] kconfig: dont crash on NULL expressions in expr_eq() Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 30/62] perf/x86/intel: Fix PT PMI handling Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 31/62] fs: avoid softlockups in s_inodes iterators Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 32/62] net: stmmac: Do not accept invalid MTU values Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 33/62] net: stmmac: RX buffer size must be 16 byte aligned Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 34/62] s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 35/62] s390/dasd: fix memleak in path handling error case Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 36/62] block: fix memleak when __blk_rq_map_user_iov() is failed Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 37/62] parisc: Fix compiler warnings in debug_core.c Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 38/62] llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c) Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 39/62] hv_netvsc: Fix unwanted rx_table reset Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 40/62] bpf: reject passing modified ctx to helper functions Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 41/62] bpf: Fix passing modified ctx to ld/abs/ind instruction Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 42/62] PCI/switchtec: Read all 64 bits of part_event_bitmap Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 43/62] mmc: block: Convert RPMB to a character device Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 44/62] mmc: block: Delete mmc_access_rpmb() Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 45/62] mmc: block: Fix bug when removing RPMB chardev Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 46/62] mmc: core: Prevent bus reference leak in mmc_blk_init() Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 47/62] mmc: block: propagate correct returned value in mmc_rpmb_ioctl Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 48/62] gtp: fix bad unlock balance in gtp_encap_enable_socket Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 49/62] macvlan: do not assume mac_header is set in macvlan_broadcast() Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 50/62] net: dsa: mv88e6xxx: Preserve priority when setting CPU port Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 51/62] net: stmmac: dwmac-sun8i: Allow all RGMII modes Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 52/62] net: stmmac: dwmac-sunxi: " Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 53/62] net: usb: lan78xx: fix possible skb leak Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 54/62] pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 55/62] USB: core: fix check for duplicate endpoints Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 56/62] USB: serial: option: add Telit ME910G1 0x110a composition Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 57/62] sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 58/62] tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 59/62] vxlan: fix tos value before xmit Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 60/62] vlan: vlan_changelink() should propagate errors Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 61/62] net: sch_prio: When ungrafting, replace with FIFO Greg Kroah-Hartman
2020-01-11 9:50 ` [PATCH 4.14 62/62] vlan: fix memory leak in vlan_dev_set_egress_priority Greg Kroah-Hartman
2020-01-11 14:55 ` [PATCH 4.14 00/62] 4.14.164-stable review Guenter Roeck
2020-01-11 18:38 ` Naresh Kamboju
2020-01-13 15:47 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200111094842.726629076@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).