diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-09 11:25:43 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-09 19:38:16 +0200 |
| commit | 34aae2c2fb1e3d88a5aeee16715cb6bf0336cdce (patch) | |
| tree | 9e88b60247f1de1e8af590f2bb67ce4d78ea0413 /net/netfilter/nft_dynset.c | |
| parent | b8c3bf0ed2edf2deaedba5f0bf0bb54c76dee71d (diff) | |
| download | linux-34aae2c2fb1e3d88a5aeee16715cb6bf0336cdce.tar.bz2 | |
netfilter: nf_tables: validate variable length element extension
Update template to validate variable length extensions. This patch adds
a new .ext_len[id] field to the template to store the expected extension
length. This is used to sanity check the initialization of the variable
length extension.
Use PTR_ERR() in nft_set_elem_init() to report errors since, after this
update, there are two reason why this might fail, either because of
ENOMEM or insufficient room in the extension field (EINVAL).
Kernels up until 7e6bc1f6cabc ("netfilter: nf_tables: stricter
validation of element data") allowed to copy more data to the extension
than was allocated. This ext_len field allows to validate if the
destination has the correct size as additional check.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_dynset.c')
| -rw-r--r-- | net/netfilter/nft_dynset.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index 22f70b543fa2..6983e6ddeef9 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -60,7 +60,7 @@ static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr, ®s->data[priv->sreg_key], NULL, ®s->data[priv->sreg_data], timeout, 0, GFP_ATOMIC); - if (elem == NULL) + if (IS_ERR(elem)) goto err1; ext = nft_set_elem_ext(set, elem); |