Re: [PATCH] Netfilter: Fix integer overflow in net/ipv6/netfilter/ip6_tables.c (fwd)

[Eric Dumazet <eric.dumazet@gmail.com>]

Le lundi 22 mars 2010 à 08:50 +1100, James Morris a écrit :
> ---------- Forwarded message ----------
> Date: Sat, 20 Mar 2010 22:32:40 +0800
> From: wzt.wzt@gmail.com
> To: linux-kernel@vger.kernel.org
> Cc: netfilter-devel@vger.kernel.org, kaber@trash.net
> Subject: [PATCH] Netfilter: Fix integer overflow in
>     net/ipv6/netfilter/ip6_tables.c
> 
> The get.size field in the get_entries() interface is not bounded
> correctly. The size is used to determine the total entry size.
> The size is bounded, but can overflow and so the size checks may
> not be sufficient to catch invalid size. Fix it by catching size
> values that would cause overflows before calculating the size.
> 
> Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com>
> 


Unless I am wrong, this patch is not necessary, since we do a bit
later :


                if (get.size == private->size)
                        ret = copy_entries_to_user(private->size,
                                                   t, uptr->entrytable);
                else {
                        duprintf("get_entries: I've got %u not %u!\n",
                                 private->size, get.size);
                        ret = -EAGAIN;
                }

So if get.size doesnt match private->size (kernel certified), we exit
with an error. No calculation, no overflow involved.