Eric Dumazet f9845426f4 netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user ... commit e466af75c0 upstream. syzkaller reports an out of bound read in strlcpy(), triggered by xt_copy_counters_from_user() Fix this by using memcpy(), then forcing a zero byte at the last position of the destination, as Florian did for the non COMPAT code. Fixes: d7591f0c41 ("netfilter: x_tables: introduce and use xt_copy_counters_from_user") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Greg Hackmann <ghackmann@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-09-19 22:48:59 +02:00
..
ipset	netfilter: ipset: Fix hash type expire: release empty hash bucket block	2015-11-07 11:28:49 +01:00
ipvs	ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()	2018-09-15 09:40:38 +02:00
core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-10-24 06:54:12 -07:00
Kconfig	netfilter: fix xt_TEE and xt_TPROXY dependencies	2015-11-10 23:46:57 +01:00
Makefile	netfilter: rename nfnetlink_queue_core.c to nfnetlink_queue.c	2015-10-04 21:45:44 +02:00
nf_conntrack_acct.c
nf_conntrack_amanda.c
nf_conntrack_broadcast.c
nf_conntrack_core.c	netfilter: restart search if moved to other chain	2018-01-31 12:06:10 +01:00
nf_conntrack_ecache.c	netfilter: invoke synchronize_rcu after set the _hook_ to NULL	2017-10-08 10:14:19 +02:00
nf_conntrack_expect.c	netfilter: nf_ct_expect: remove the redundant slash when policy name is empty	2018-01-31 12:06:10 +01:00
nf_conntrack_extend.c	netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister	2017-08-24 17:02:34 -07:00
nf_conntrack_ftp.c
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c
nf_conntrack_h323_types.c
nf_conntrack_helper.c
nf_conntrack_irc.c
nf_conntrack_l3proto_generic.c
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c	netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize	2018-04-13 19:50:10 +02:00
nf_conntrack_pptp.c
nf_conntrack_proto_dccp.c	netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state	2018-08-24 13:27:01 +02:00
nf_conntrack_proto_generic.c	netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple	2015-09-18 22:00:04 +02:00
nf_conntrack_proto_gre.c	netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple	2015-09-18 22:00:04 +02:00
nf_conntrack_proto_sctp.c	netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple	2015-09-18 22:00:04 +02:00
nf_conntrack_proto_tcp.c	netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple	2015-09-18 22:00:04 +02:00
nf_conntrack_proto_udp.c	netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple	2015-09-18 22:00:04 +02:00
nf_conntrack_proto_udplite.c	netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple	2015-09-18 22:00:04 +02:00
nf_conntrack_proto.c
nf_conntrack_sane.c
nf_conntrack_seqadj.c
nf_conntrack_sip.c	netfilter: nf_conntrack_sip: extend request line validation	2018-01-31 12:06:10 +01:00
nf_conntrack_snmp.c
nf_conntrack_standalone.c
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c
nf_internals.h
nf_log_common.c
nf_log.c	netfilter: nf_log: don't hold nf_log_mutex during user access	2018-07-11 16:03:51 +02:00
nf_nat_amanda.c
nf_nat_core.c	netfilter: invoke synchronize_rcu after set the _hook_ to NULL	2017-10-08 10:14:19 +02:00
nf_nat_ftp.c
nf_nat_helper.c
nf_nat_irc.c
nf_nat_proto_common.c	netfilter: nat: cope with negative port range	2018-03-18 11:17:51 +01:00
nf_nat_proto_dccp.c
nf_nat_proto_sctp.c
nf_nat_proto_tcp.c
nf_nat_proto_udp.c
nf_nat_proto_udplite.c
nf_nat_proto_unknown.c
nf_nat_redirect.c	netfilter: nf_nat_redirect: add missing NULL pointer check	2015-10-27 06:54:56 +01:00
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c	netfilter: nf_queue: Make the queue_handler pernet	2018-02-16 20:09:40 +01:00
nf_sockopt.c
nf_synproxy_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2015-09-05 21:57:42 -07:00
nf_tables_api.c	netfilter: nf_tables: fix oob access	2017-11-30 08:37:27 +00:00
nf_tables_core.c	netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()	2018-07-11 16:03:47 +02:00
nf_tables_inet.c
nf_tables_netdev.c	netfilter: nf_tables: use skb->protocol instead of assuming ethernet header	2015-12-18 14:45:45 +01:00
nfnetlink_acct.c
nfnetlink_cthelper.c	netfilter: nfnetlink_cthelper: Add missing permission checks	2018-01-31 12:06:11 +01:00
nfnetlink_cttimeout.c	netfilter: invoke synchronize_rcu after set the _hook_ to NULL	2017-10-08 10:14:19 +02:00
nfnetlink_log.c	netfilter: nfnetlink_log: work around uninitialized variable warning	2015-11-10 23:46:36 +01:00
nfnetlink_queue.c	netfilter: nf_queue: augment nfqa_cfg_policy	2018-07-17 11:31:46 +02:00
nfnetlink.c	netfilter: nfnetlink: correctly validate length of batch messages	2017-04-30 05:49:28 +02:00
nft_bitwise.c
nft_byteorder.c
nft_cmp.c
nft_compat.c	netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC	2015-09-14 18:10:57 +02:00
nft_counter.c	netfilter: nf_tables: add clone interface to expression operations	2015-11-10 23:47:32 +01:00
nft_ct.c	netfilter: nft_ct: include direction when dumping NFT_CT_L3PROTOCOL key	2015-12-18 14:45:45 +01:00
nft_dynset.c	netfilter: nft_dynset: fix element timeout for HZ != 1000	2016-11-26 09:54:54 +01:00
nft_exthdr.c
nft_hash.c
nft_immediate.c
nft_limit.c
nft_log.c	netfilter: nf_tables: Use pkt->net instead of computing net from the passed net_devices	2015-09-18 21:58:49 +02:00
nft_lookup.c
nft_masq.c
nft_meta.c	netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family	2017-11-15 17:13:10 +01:00
nft_nat.c
nft_payload.c
nft_queue.c	netfilter: nft_queue: use raw_smp_processor_id()	2017-11-30 08:37:27 +00:00
nft_rbtree.c
nft_redir.c
nft_reject_inet.c	ipv4: Push struct net down into nf_send_reset	2015-09-29 20:21:31 +02:00
nft_reject.c
x_tables.c	netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user	2018-09-19 22:48:59 +02:00
xt_addrtype.c	netfilter: x_tables: Use par->net instead of computing from the passed net devices	2015-09-18 21:58:25 +02:00
xt_AUDIT.c
xt_bpf.c
xt_cgroup.c
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_cluster.c
xt_comment.c
xt_connbytes.c
xt_connlabel.c
xt_connlimit.c	netfilter: nf_conntrack: Add a struct net parameter to l4_pkt_to_tuple	2015-09-18 22:00:04 +02:00
xt_connmark.c
xt_CONNSECMARK.c
xt_conntrack.c
xt_cpu.c
xt_CT.c	netfilter: xt_CT: fix refcnt leak on error path	2018-03-24 10:58:43 +01:00
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c	netfilter: x_tables: add and use xt_check_proc_name	2018-04-08 11:51:59 +02:00
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c	netfilter: IDLETIMER: be syzkaller friendly	2018-03-18 11:17:51 +01:00
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c	ipvs: Pass ipvs into conn_out_get	2015-09-24 09:34:41 +09:00
xt_l2tp.c
xt_LED.c	netfilter: x_tables: fix missing timer initialization in xt_LED	2018-03-18 11:17:51 +01:00
xt_length.c
xt_limit.c
xt_LOG.c	netfilter: x_tables: Use par->net instead of computing from the passed net devices	2015-09-18 21:58:25 +02:00
xt_mac.c
xt_mark.c
xt_multiport.c
xt_nat.c
xt_NETMAP.c
xt_nfacct.c
xt_NFLOG.c	netfilter: x_tables: Use par->net instead of computing from the passed net devices	2015-09-18 21:58:25 +02:00
xt_NFQUEUE.c
xt_osf.c	netfilter: xt_osf: Add missing permission checks	2018-01-31 12:06:11 +01:00
xt_owner.c	netfilter: xt_owner: use skb_to_full_sk() helper	2015-11-08 20:56:39 -05:00
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_rateest.c
xt_RATEEST.c	netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert	2018-02-25 11:03:37 +01:00
xt_realm.c
xt_recent.c	netfilter: x_tables: add and use xt_check_proc_name	2018-04-08 11:51:59 +02:00
xt_REDIRECT.c
xt_repldata.h
xt_sctp.c
xt_SECMARK.c
xt_set.c
xt_socket.c	netfilter: x_tables: Use par->net instead of computing from the passed net devices	2015-09-18 21:58:25 +02:00
xt_state.c
xt_statistic.c
xt_string.c
xt_tcpmss.c
xt_TCPMSS.c	netfilter: xt_TCPMSS: add more sanity tests on tcph->doff	2017-07-05 14:37:15 +02:00
xt_TCPOPTSTRIP.c
xt_tcpudp.c
xt_TEE.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2015-11-04 20:47:50 -05:00
xt_time.c
xt_TPROXY.c	netfilter: x_tables: Use par->net instead of computing from the passed net devices	2015-09-18 21:58:25 +02:00
xt_TRACE.c
xt_u32.c