[PATCH net] netfilter: nf_flow_table_offload: fix heap overflow in flow_action_entry_next()

[Hyunwoo Kim <imv4bel@gmail.com>]

flow_action_entry_next() increments num_entries and returns a pointer
into the flow_action_entry array without any bounds checking.  The array
is allocated with a fixed size of NF_FLOW_RULE_ACTION_MAX (16) entries,
but certain combinations of IPv6 + SNAT + DNAT + double VLAN (QinQ)
require 17 or more entries, causing a slab-out-of-bounds write in the
kmalloc-4k slab.

The maximum possible entry count is:
  tunnel(2) + eth(4) + VLAN(4) + IPv6_NAT(10) + redirect(1) = 21

Increase NF_FLOW_RULE_ACTION_MAX to 24 (with headroom) to cover the
worst case.

Fixes: efce49dfe6a8 ("netfilter: flowtable: add vlan pop action offload support")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 net/netfilter/nf_flow_table_offload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 9b677e116487..e843f6d0355e 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -727,7 +727,7 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow,
 }
 EXPORT_SYMBOL_GPL(nf_flow_rule_route_ipv6);
 
-#define NF_FLOW_RULE_ACTION_MAX	16
+#define NF_FLOW_RULE_ACTION_MAX	24
 
 static struct nf_flow_rule *
 nf_flow_offload_rule_alloc(struct net *net,
-- 
2.43.0