netfilter: x_tables: fix incorrect parameter length before call copy_from_sockptr

[PATCH] netfilter: x_tables: fix incorrect parameter length before call copy_from_sockptr

Posted by Edward Adam Davis 1 year, 10 months ago

If len < sizeof(tmp) it will trigger oob, so take the min of them.

Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 net/ipv4/netfilter/arp_tables.c | 4 ++--
 net/ipv4/netfilter/ip_tables.c  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 2407066b0fec..dc9166b48069 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -956,7 +956,7 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len)
 	void *loc_cpu_entry;
 	struct arpt_entry *iter;
 
-	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
+	if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0)
 		return -EFAULT;
 
 	/* overflow check */
@@ -1254,7 +1254,7 @@ static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
 	void *loc_cpu_entry;
 	struct arpt_entry *iter;
 
-	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
+	if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0)
 		return -EFAULT;
 
 	/* overflow check */
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 7da1df4997d0..94a0afd8f94f 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1108,7 +1108,7 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len)
 	void *loc_cpu_entry;
 	struct ipt_entry *iter;
 
-	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
+	if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0)
 		return -EFAULT;
 
 	/* overflow check */
@@ -1492,7 +1492,7 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len)
 	void *loc_cpu_entry;
 	struct ipt_entry *iter;
 
-	if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0)
+	if (copy_from_sockptr(&tmp, arg, min_t(unsigned int, sizeof(tmp), len)) != 0)
 		return -EFAULT;
 
 	/* overflow check */
-- 
2.43.0

Re: [PATCH] netfilter: x_tables: fix incorrect parameter length before call copy_from_sockptr

Posted by Eric Dumazet 1 year, 10 months ago

On 4/9/24 17:00, Edward Adam Davis wrote:
> If len < sizeof(tmp) it will trigger oob, so take the min of them.
>
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>   net/ipv4/netfilter/arp_tables.c | 4 ++--
>   net/ipv4/netfilter/ip_tables.c  | 4 ++--
>   2 files changed, 4 insertions(+), 4 deletions(-)

Hi Edward

Already fixed in net tree


https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=0c83842df40f86e529db6842231154772c20edcc

Also a followup has been sent today

https://lore.kernel.org/netdev/20240409120741.3538135-1-edumazet@google.com/T/#u

Thanks.