Florian Westphal 5c04da55c7 netfilter: ebtables: reject bogus getopt len value ... syzkaller reports splat: ------------[ cut here ]------------ Buffer overflow detected (80 < 137)! Call Trace: do_ebt_get_ctl+0x2b4/0x790 net/bridge/netfilter/ebtables.c:2317 nf_getsockopt+0x72/0xd0 net/netfilter/nf_sockopt.c:116 ip_getsockopt net/ipv4/ip_sockglue.c:1778 [inline] caused by a copy-to-user with a too-large "*len" value. This adds a argument check on *len just like in the non-compat version of the handler. Before the "Fixes" commit, the reproducer fails with -EINVAL as expected: 1. core calls the "compat" getsockopt version 2. compat getsockopt version detects the *len value is possibly in 64-bit layout (*len != compat_len) 3. compat getsockopt version delegates everything to native getsockopt version 4. native getsockopt rejects invalid *len -> compat handler only sees len == sizeof(compat_struct) for GET_ENTRIES. After the refactor, event sequence is: 1. getsockopt calls "compat" version (len != native_len) 2. compat version attempts to copy *len bytes, where *len is random value from userspace Fixes: fc66de8e16 ("netfilter/ebtables: clean up compat {get, set}sockopt handling") Reported-by: syzbot+5accb5c62faa1d346480@syzkaller.appspotmail.com Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2020-08-14 11:59:08 +02:00
..
netfilter	netfilter: ebtables: reject bogus getopt len value	2020-08-14 11:59:08 +02:00
br_arp_nd_proxy.c
br_device.c	net: bridge: clear bridge's private skb space on xmit	2020-08-03 15:26:46 -07:00
br_fdb.c
br_forward.c
br_if.c
br_input.c
br_ioctl.c
br_mdb.c
br_mrp_netlink.c	bridge: mrp: Extend br_mrp_fill_info	2020-07-14 13:46:43 -07:00
br_mrp_switchdev.c	bridge: switchdev: mrp: Extend MRP API for switchdev for MRP Interconnect	2020-07-14 13:46:43 -07:00
br_mrp.c	bridge: mrp: Implement the MRP Interconnect API	2020-07-14 13:46:43 -07:00
br_multicast.c	bridge: mcast: Fix MLD2 Report IPv6 payload length check	2020-07-07 15:37:57 -07:00
br_netfilter_hooks.c
br_netfilter_ipv6.c
br_netlink_tunnel.c	net: bridge: notify on vlan tunnel changes done via the old api	2020-07-12 15:18:24 -07:00
br_netlink.c	net: bridge: Add port attribute IFLA_BRPORT_MRP_IN_OPEN	2020-07-14 13:46:43 -07:00
br_nf_core.c
br_private_mrp.h	bridge: mrp: Implement the MRP Interconnect API	2020-07-14 13:46:43 -07:00
br_private_stp.h
br_private_tunnel.h
br_private.h	net: bridge: fix undefined br_vlan_can_enter_range in tunnel code	2020-07-13 11:22:55 -07:00
br_stp_bpdu.c
br_stp_if.c
br_stp_timer.c
br_stp.c
br_switchdev.c
br_sysfs_br.c
br_sysfs_if.c
br_vlan_options.c
br_vlan_tunnel.c
br_vlan.c
br.c
Kconfig
Makefile