kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/net
History
Florian Westphal a6527128fe net/sched: act_ipt: add sanity checks on table name and hook locations 
[ Upstream commit b4ee93380b ]

Looks like "tc" hard-codes "mangle" as the only supported table
name, but on kernel side there are no checks.

This is wrong.  Not all xtables targets are safe to call from tc.
E.g. "nat" targets assume skb has a conntrack object assigned to it.
Normally those get called from netfilter nat core which consults the
nat table to obtain the address mapping.

"tc" userspace either sets PRE or POSTROUTING as hook number, but there
is no validation of this on kernel side, so update netlink policy to
reject bogus numbers.  Some targets may assume skb_dst is set for
input/forward hooks, so prevent those from being used.

act_ipt uses the hook number in two places:
1. the state hook number, this is fine as-is
2. to set par.hook_mask

The latter is a bit mask, so update the assignment to make
xt_check_target() to the right thing.

Followup patch adds required checks for the skb/packet headers before
calling the targets evaluation function.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-07-23 13:47:28 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 2023-04-20 12:13:53 +02:00
802 mrp: introduce active flags to prevent UAF when applicant uninit 2022-12-31 13:14:42 +01:00
8021q vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() 2023-05-24 17:36:52 +01:00
appletalk net: socket: rework compat_ifreq_ioctl() 2021-07-23 14:20:25 +01:00
atm atm: hide unused procfs functions 2023-06-09 10:32:26 +02:00
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-22 14:22:01 +02:00
batman-adv batman-adv: Broken sync while rescheduling delayed work 2023-06-14 11:13:04 +02:00
bluetooth Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk 2023-06-14 11:13:06 +02:00
bpf bpf: Move skb->len == 0 checks into __bpf_redirect 2022-12-31 13:14:11 +01:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge bridge: always declare tunnel functions 2023-05-24 17:36:52 +01:00
caif net: caif: Fix use-after-free in cfusbl_device_notify() 2023-03-17 08:48:54 +01:00
can can: isotp: isotp_sendmsg(): fix return error fix on TX path 2023-07-05 18:25:05 +01:00
ceph libceph: fix potential use-after-free on linger ping and resends 2022-05-25 09:57:28 +02:00
core netlink: Add __sock_i_ino() for __netlink_diag_dump(). 2023-07-23 13:46:56 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:12:52 +01:00
dccp dccp: Call inet6_destroy_sock() via sk->sk_destruct(). 2023-04-26 13:51:54 +02:00
dns_resolver net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
dsa net: dsa: tag_brcm: legacy: fix daisy-chained switches 2023-03-30 12:47:48 +02:00
ethernet move netdev_boot_setup into Space.c 2021-08-03 13:05:26 +01:00
ethtool ethtool: Fix uninitialized number of lanes 2023-05-17 11:50:18 +02:00
hsr hsr: ratelimit only when errors are printed 2023-04-05 11:25:02 +02:00
ieee802154 net: ieee802154: fix error return code in dgram_bind() 2022-11-03 23:59:14 +09:00
ife net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
ipv4 xfrm: Linearize the skb after offloading if needed. 2023-06-28 10:29:46 +02:00
ipv6 xfrm: Linearize the skb after offloading if needed. 2023-06-28 10:29:46 +02:00
iucv net/iucv: Fix size of interrupt data 2023-03-22 13:31:28 +01:00
kcm kcm: close race conditions on sk_receive_queue 2022-11-26 09:24:50 +01:00
key af_key: Reject optional tunnel/BEET mode templates in outbound policies 2023-05-24 17:36:49 +01:00
l2tp inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-04-26 13:51:54 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 14:38:53 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc net: deal with most data-races in sk_wait_event() 2023-05-24 17:36:42 +01:00
mac80211 wifi: mac80211: simplify chanctx allocation 2023-06-09 10:32:25 +02:00
mac802154 mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() 2022-12-14 11:37:25 +01:00
mctp net: mctp: purge receive queues on sk destruction 2023-02-06 07:59:02 +01:00
mpls net: mpls: fix stale pointer if allocation fails during device rename 2023-02-22 12:57:09 +01:00
mptcp mptcp: consolidate fallback and non fallback state machine 2023-07-05 18:25:04 +01:00
ncsi net/ncsi: clear Tx enable mode when handling a Config required AEN 2023-05-17 11:50:16 +02:00
netfilter netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. 2023-07-23 13:46:56 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-04-13 20:59:10 +02:00
netlink netlink: Add __sock_i_ino() for __netlink_diag_dump(). 2023-07-23 13:46:56 +02:00
netrom netrom: fix info-leak in nr_write_internal() 2023-06-09 10:32:16 +02:00
nfc net: nfc: Fix use-after-free caused by nfc_llcp_find_local 2023-07-23 13:46:56 +02:00
nsh net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() 2023-05-24 17:36:51 +01:00
openvswitch net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() 2023-02-22 12:57:09 +01:00
packet af_packet: do not use READ_ONCE() in packet_bind() 2023-06-09 10:32:17 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:35:16 +01:00
psample psample: Add additional metadata attributes 2021-03-14 15:00:43 -07:00
qrtr net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() 2023-04-20 12:13:53 +02:00
rds rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-03-10 09:39:16 +01:00
rfkill rfkill: make new event layout opt-in 2022-04-08 14:23:00 +02:00
rose net/rose: Fix to not accept on connected socket 2023-02-22 12:57:02 +01:00
rxrpc rxrpc: Fix hard call timeout units 2023-05-17 11:50:17 +02:00
sched net/sched: act_ipt: add sanity checks on table name and hook locations 2023-07-23 13:47:28 +02:00
sctp sctp: fix potential deadlock on &net->sctp.addr_wq_lock 2023-07-23 13:47:27 +02:00
smc net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT 2023-06-14 11:13:01 +02:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 19:17:11 +01:00
sunrpc SUNRPC: Fix UAF in svc_tcp_listen_data_ready() 2023-07-23 13:47:20 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc net: tipc: resize nlattr array to correct size 2023-06-21 15:59:18 +02:00
tls net: deal with most data-races in sk_wait_event() 2023-05-24 17:36:42 +01:00
unix af_unix: Fix data races around sk->sk_shutdown. 2023-05-24 17:36:42 +01:00
vmw_vsock vsock: avoid to close connected socket after the timeout 2023-05-24 17:36:49 +01:00
wireless wifi: cfg80211: rewrite merging of inherited elements 2023-07-23 13:46:53 +02:00
x25 net/x25: Fix to not accept on connected socket 2023-02-09 11:26:40 +01:00
xdp xsk: Fix unaligned descriptor validation 2023-05-11 23:00:27 +09:00
xfrm xfrm: Ensure policies always checked on XFRM-I input path 2023-06-28 10:29:45 +02:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: annotate sk->sk_err write from do_recvmmsg() 2023-05-24 17:36:42 +01:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00