netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
	Pablo Neira Ayuso <pablo@netfilter.org>,
	Sasha Levin <sashal@kernel.org>,
	netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.0 64/99] netfilter: nf_tables: prevent shift wrap in nft_chain_parse_hook()
Date: Tue,  7 May 2019 01:31:58 -0400	[thread overview]
Message-ID: <20190507053235.29900-64-sashal@kernel.org> (raw)
In-Reply-To: <20190507053235.29900-1-sashal@kernel.org>

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 33d1c018179d0a30c39cc5f1682b77867282694b ]

I believe that "hook->num" can be up to UINT_MAX.  Shifting more than
31 bits would is undefined in C but in practice it would lead to shift
wrapping.  That would lead to an array overflow in nf_tables_addchain():

	ops->hook       = hook.type->hooks[ops->hooknum];

Fixes: fe19c04ca137 ("netfilter: nf_tables: remove nhooks field from struct nft_af_info")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_tables_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e2aac80f9b7b..25c2b98b9a96 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1502,7 +1502,7 @@ static int nft_chain_parse_hook(struct net *net,
 		if (IS_ERR(type))
 			return PTR_ERR(type);
 	}
-	if (!(type->hook_mask & (1 << hook->num)))
+	if (hook->num > NF_MAX_HOOKS || !(type->hook_mask & (1 << hook->num)))
 		return -EOPNOTSUPP;
 
 	if (type->type == NFT_CHAIN_T_NAT &&
-- 
2.20.1


  parent reply	other threads:[~2019-05-07  6:04 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20190507053235.29900-1-sashal@kernel.org>
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 11/99] mac80211: fix unaligned access in mesh table hash function Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 12/99] mac80211: Increase MAX_MSG_LEN Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 13/99] cfg80211: Handle WMM rules in regulatory domain intersection Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 14/99] mac80211: fix memory accounting with A-MSDU aggregation Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 15/99] nl80211: Add NL80211_FLAG_CLEAR_SKB flag for other NL commands Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 20/99] mac80211: Honor SW_CRYPTO_CONTROL for unicast keys in AP VLAN mode Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 26/99] selftests: fib_tests: Fix 'Command line is not complete' errors Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 28/99] mISDN: Check address length before reading address family Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 29/99] vxge: fix return of a free'd memblock on a failed dma mapping Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 30/99] qede: fix write to free'd pointer error and double free of ptp Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 34/99] qed: Delete redundant doorbell recovery types Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 35/99] qed: Fix the doorbell address sanity check Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 36/99] qed: Fix missing DORQ attentions Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 37/99] qed: Fix the DORQ's attentions handling Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 52/99] ocelot: Don't sleep in atomic context (irqs_disabled()) Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 62/99] ipvs: do not schedule icmp errors from tunnels Sasha Levin
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 63/99] netfilter: ctnetlink: don't use conntrack/expect object addresses as id Sasha Levin
2019-05-07  5:31 ` Sasha Levin [this message]
2019-05-07  5:31 ` [PATCH AUTOSEL 5.0 65/99] netfilter: nat: fix icmp id randomization Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 71/99] of_net: Fix residues after of_get_nvmem_mac_address removal Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 72/99] selftests/net: correct the return value for run_netsocktests Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 73/99] selftests/net: correct the return value for run_afpackettests Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 74/99] netfilter: never get/set skb->tstamp Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 75/99] netfilter: fix nf_l4proto_log_invalid to log invalid packets Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 82/99] spi: Micrel eth switch: declare missing of table Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 90/99] net: vrf: Fix operation not supported when set vrf mac Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 96/99] bpf: only test gso type on gso packets Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 97/99] net: sched: fix cleanup NULL pointer exception in act_mirr Sasha Levin
2019-05-07  5:32 ` [PATCH AUTOSEL 5.0 98/99] net: mvpp2: fix validate for PPv2.1 Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190507053235.29900-64-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=coreteam@netfilter.org \
    --cc=dan.carpenter@oracle.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).