github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: sched: em_ipt: validate hook value from netlink

Browse Source 
em_ipt_change() accepts the user-provided TCA_EM_IPT_HOOK value
without validating its range.

The value is later used in check_match() as "1 << im->hook".  A hook
value of 32 or greater causes undefined behavior and may undermine the
xt match hook-mask validation.  The value is also passed to
nf_hook_state_init() as a hook index.

Reject hook values outside the supported IPv4/IPv6 Netfilter hook
range after checking the required attributes, before loading the xt
match or allocating the match state.

Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
This commit is contained in:
Fang Xieyan 2026-10-26 17:07:17 +08:00 committed by Dave Miller
parent 083aaafd45
commit 94cea342e8
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/sched/em_ipt.c
View File

@ -141,6 +141,9 @@ static int em_ipt_change(struct net *net, void *data, int data_len,
!tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
return -EINVAL;
if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) >= NF_INET_NUMHOOKS)
return -EINVAL;
nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
switch (nfproto) {
case NFPROTO_IPV4: