Commit 3ce67e37 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: do not allow mismatch field size and set key length 



The set description provides the size of each field in the set whose sum
should not mismatch the set key length, bail out otherwise.

I did not manage to crash nft_set_pipapo with mismatch fields and set key
length so far, but this is UB which must be disallowed.

Fixes: f3a2181e ("netfilter: nf_tables: Support for sets with multiple ranged fields")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent b1db244f

net/netfilter/nf_tables_api.c

+5 −1
Original line number Diff line number Diff line
@@ -4813,8 +4813,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, 
static int nft_set_desc_concat(struct nft_set_desc *desc,

			       const struct nlattr *nla)

{

	u32 num_regs = 0, key_num_regs = 0;

	struct nlattr *attr;

	u32 num_regs = 0;

	int rem, err, i;



	nla_for_each_nested(attr, nla, rem) {
@@ -4829,6 +4829,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, 
	for (i = 0; i < desc->field_count; i++)

		num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32));



	key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32));

	if (key_num_regs != num_regs)

		return -EINVAL;



	if (num_regs > NFT_REG32_COUNT)

		return -E2BIG;