[PATCH] netfilter: ctnetlink: validate CTA_EXPECT_NAT_DIR value

[Jenny Guanni Qu <qguanni@gmail.com>]

ctnetlink_parse_expect_nat() reads the CTA_EXPECT_NAT_DIR attribute
from userspace via netlink and assigns it to exp->dir without checking
whether it is a valid direction value. Since exp->dir is used as an
array index into the 2-element tuplehash[] array, an out-of-range
value causes an out-of-bounds access.

Add a bounds check to ensure the direction is less than IP_CT_DIR_MAX.

Fixes: 076a0ca02644 ("netfilter: ctnetlink: add NAT support for expectations")
Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
---
 net/netfilter/nf_conntrack_netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 6a1239433830..ddf3a417f408 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -3496,6 +3496,8 @@ ctnetlink_parse_expect_nat(const struct nlattr *attr,
 	exp->saved_addr = nat_tuple.src.u3;
 	exp->saved_proto = nat_tuple.src.u;
 	exp->dir = ntohl(nla_get_be32(tb[CTA_EXPECT_NAT_DIR]));
+	if (exp->dir >= IP_CT_DIR_MAX)
+		return -EINVAL;
 
 	return 0;
 #else
-- 
2.34.1