* [PATCH] netfilter: avoid array overflow in nf_register_hook
@ 2013-08-24 3:07 Dong Fang
2013-08-23 18:14 ` Sergei Shtylyov
0 siblings, 1 reply; 4+ messages in thread
From: Dong Fang @ 2013-08-24 3:07 UTC (permalink / raw)
To: pablo, kaber, kadlec, davem, yp.fangdong
Cc: netfilter-devel, netfilter, coreteam, netdev
This patch fix the array overflow in nf_register_hook function
Signed-off-by: Dong Fang <yp.fangdong@gmail.com>
---
net/netfilter/core.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 2217363..819eee1 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -68,8 +68,11 @@ static DEFINE_MUTEX(nf_hook_mutex);
int nf_register_hook(struct nf_hook_ops *reg)
{
struct nf_hook_ops *elem;
- int err;
+ int err = -EINVAL;
+ if (reg->pf >= NFPROTO_NUMPROTO || reg->hooknum >= NF_MAX_HOOKS)
+ return err;
+
err = mutex_lock_interruptible(&nf_hook_mutex);
if (err < 0)
return err;
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] netfilter: avoid array overflow in nf_register_hook
2013-08-24 3:07 [PATCH] netfilter: avoid array overflow in nf_register_hook Dong Fang
@ 2013-08-23 18:14 ` Sergei Shtylyov
0 siblings, 0 replies; 4+ messages in thread
From: Sergei Shtylyov @ 2013-08-23 18:14 UTC (permalink / raw)
To: Dong Fang
Cc: pablo, kaber, kadlec, davem, netfilter-devel, netfilter, coreteam,
netdev
Hello.
On 08/24/2013 07:07 AM, Dong Fang wrote:
> This patch fix the array overflow in nf_register_hook function
> Signed-off-by: Dong Fang <yp.fangdong@gmail.com>
> ---
> net/netfilter/core.c | 5 ++++-
> 1 files changed, 4 insertions(+), 1 deletions(-)
> diff --git a/net/netfilter/core.c b/net/netfilter/core.c
> index 2217363..819eee1 100644
> --- a/net/netfilter/core.c
> +++ b/net/netfilter/core.c
> @@ -68,8 +68,11 @@ static DEFINE_MUTEX(nf_hook_mutex);
> int nf_register_hook(struct nf_hook_ops *reg)
> {
> struct nf_hook_ops *elem;
> - int err;
> + int err = -EINVAL;
>
> + if (reg->pf >= NFPROTO_NUMPROTO || reg->hooknum >= NF_MAX_HOOKS)
> + return err;
Why not just return -EINVAL and avoid unneeded 'err' initialization?
> +
> err = mutex_lock_interruptible(&nf_hook_mutex);
> if (err < 0)
> return err;
WBR, Sergei
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] netfilter: avoid array overflow in nf_register_hook
@ 2013-08-24 3:04 Dong Fang
2013-08-23 16:05 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: Dong Fang @ 2013-08-24 3:04 UTC (permalink / raw)
To: pablo, kaber, kadlec, davem
Cc: netfilter-devel, netfilter, coreteam, netdev, Dong Fang
This patch fix the array overflow in nf_register_hook function
Signed-off-by: Dong Fang <yp.fangdong@gmail.com>
---
net/netfilter/core.c | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 2217363..819eee1 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -68,8 +68,11 @@ static DEFINE_MUTEX(nf_hook_mutex);
int nf_register_hook(struct nf_hook_ops *reg)
{
struct nf_hook_ops *elem;
- int err;
+ int err = -EINVAL;
+ if (reg->pf >= NFPROTO_NUMPROTO || reg->hooknum >= NF_MAX_HOOKS)
+ return err;
+
err = mutex_lock_interruptible(&nf_hook_mutex);
if (err < 0)
return err;
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] netfilter: avoid array overflow in nf_register_hook
2013-08-24 3:04 Dong Fang
@ 2013-08-23 16:05 ` Eric Dumazet
0 siblings, 0 replies; 4+ messages in thread
From: Eric Dumazet @ 2013-08-23 16:05 UTC (permalink / raw)
To: Dong Fang
Cc: pablo, kaber, kadlec, davem, netfilter-devel, netfilter, coreteam,
netdev
On Fri, 2013-08-23 at 23:04 -0400, Dong Fang wrote:
> This patch fix the array overflow in nf_register_hook function
>
> Signed-off-by: Dong Fang <yp.fangdong@gmail.com>
> ---
> net/netfilter/core.c | 5 ++++-
> 1 files changed, 4 insertions(+), 1 deletions(-)
>
> diff --git a/net/netfilter/core.c b/net/netfilter/core.c
> index 2217363..819eee1 100644
> --- a/net/netfilter/core.c
> +++ b/net/netfilter/core.c
> @@ -68,8 +68,11 @@ static DEFINE_MUTEX(nf_hook_mutex);
> int nf_register_hook(struct nf_hook_ops *reg)
> {
> struct nf_hook_ops *elem;
> - int err;
> + int err = -EINVAL;
>
> + if (reg->pf >= NFPROTO_NUMPROTO || reg->hooknum >= NF_MAX_HOOKS)
> + return err;
> +
Thats a bug in the caller.
We want a hard crash so that the poor netfilter guy who made this error
can fix the bug before sending us a buggy patch.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-08-24 3:07 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-08-24 3:07 [PATCH] netfilter: avoid array overflow in nf_register_hook Dong Fang
2013-08-23 18:14 ` Sergei Shtylyov
-- strict thread matches above, loose matches on Subject: below --
2013-08-24 3:04 Dong Fang
2013-08-23 16:05 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).