* [patch] netfilter: ipset: off by one in ip_set_nfnl_get_byindex()
@ 2014-10-21 8:28 Dan Carpenter
2014-10-21 9:51 ` Jozsef Kadlecsik
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2014-10-21 8:28 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Patrick McHardy, Jozsef Kadlecsik, David S. Miller, Jiri Kosina,
Ilia Mirkin, Sergey Popovich, Joe Perches, Anton Danilov,
stephen hemminger, netfilter-devel, coreteam, kernel-janitors
The ->ip_set_list[] array is initialized in ip_set_net_init() and it
has ->ip_set_max elements so this check should be >= instead of >
otherwise we are off by one.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I am not very familiar with this code, so please review cautiously.
This is an old bug which should go to -stable.
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 912e5a0..86f9d76 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -659,7 +659,7 @@ ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
struct ip_set *set;
struct ip_set_net *inst = ip_set_pernet(net);
- if (index > inst->ip_set_max)
+ if (index >= inst->ip_set_max)
return IPSET_INVALID_ID;
nfnl_lock(NFNL_SUBSYS_IPSET);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [patch] netfilter: ipset: off by one in ip_set_nfnl_get_byindex()
2014-10-21 8:28 [patch] netfilter: ipset: off by one in ip_set_nfnl_get_byindex() Dan Carpenter
@ 2014-10-21 9:51 ` Jozsef Kadlecsik
2014-10-22 12:11 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Jozsef Kadlecsik @ 2014-10-21 9:51 UTC (permalink / raw)
To: Dan Carpenter
Cc: Pablo Neira Ayuso, Patrick McHardy, David S. Miller, Jiri Kosina,
Ilia Mirkin, Sergey Popovich, Joe Perches, Anton Danilov,
stephen hemminger, netfilter-devel, coreteam, kernel-janitors
On Tue, 21 Oct 2014, Dan Carpenter wrote:
> The ->ip_set_list[] array is initialized in ip_set_net_init() and it
> has ->ip_set_max elements so this check should be >= instead of >
> otherwise we are off by one.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> I am not very familiar with this code, so please review cautiously.
> This is an old bug which should go to -stable.
>
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index 912e5a0..86f9d76 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -659,7 +659,7 @@ ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
> struct ip_set *set;
> struct ip_set_net *inst = ip_set_pernet(net);
>
> - if (index > inst->ip_set_max)
> + if (index >= inst->ip_set_max)
> return IPSET_INVALID_ID;
>
> nfnl_lock(NFNL_SUBSYS_IPSET);
>
Absolutely right and it should go to stable too!
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [patch] netfilter: ipset: off by one in ip_set_nfnl_get_byindex()
2014-10-21 9:51 ` Jozsef Kadlecsik
@ 2014-10-22 12:11 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2014-10-22 12:11 UTC (permalink / raw)
To: Jozsef Kadlecsik
Cc: Dan Carpenter, Patrick McHardy, David S. Miller, Jiri Kosina,
Ilia Mirkin, Sergey Popovich, Joe Perches, Anton Danilov,
stephen hemminger, netfilter-devel, coreteam, kernel-janitors
On Tue, Oct 21, 2014 at 11:51:12AM +0200, Jozsef Kadlecsik wrote:
> On Tue, 21 Oct 2014, Dan Carpenter wrote:
>
> > The ->ip_set_list[] array is initialized in ip_set_net_init() and it
> > has ->ip_set_max elements so this check should be >= instead of >
> > otherwise we are off by one.
> >
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > I am not very familiar with this code, so please review cautiously.
> > This is an old bug which should go to -stable.
> >
> > diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> > index 912e5a0..86f9d76 100644
> > --- a/net/netfilter/ipset/ip_set_core.c
> > +++ b/net/netfilter/ipset/ip_set_core.c
> > @@ -659,7 +659,7 @@ ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index)
> > struct ip_set *set;
> > struct ip_set_net *inst = ip_set_pernet(net);
> >
> > - if (index > inst->ip_set_max)
> > + if (index >= inst->ip_set_max)
> > return IPSET_INVALID_ID;
> >
> > nfnl_lock(NFNL_SUBSYS_IPSET);
> >
>
> Absolutely right and it should go to stable too!
>
> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Applied, thanks.
My script says this applies cleanly to:
3.14.x
3.16.x
3.17.x
So I'll enqueue this for those.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-10-22 12:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-21 8:28 [patch] netfilter: ipset: off by one in ip_set_nfnl_get_byindex() Dan Carpenter
2014-10-21 9:51 ` Jozsef Kadlecsik
2014-10-22 12:11 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).