| Message ID | 20250130113307.2327470-2-pablo@netfilter.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1b9335a8000fb70742f7db10af314104b6ace220 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/1] netfilter: nf_tables: reject mismatching sum of field_len with set key length | expand |
Hello: This patch was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Thu, 30 Jan 2025 12:33:07 +0100 you wrote: > The field length description provides the length of each separated key > field in the concatenation, each field gets rounded up to 32-bits to > calculate the pipapo rule width from pipapo_init(). The set key length > provides the total size of the key aligned to 32-bits. > > Register-based arithmetics still allows for combining mismatching set > key length and field length description, eg. set key length 10 and field > description [ 5, 4 ] leading to pipapo width of 12. > > [...] Here is the summary with links: - [net,1/1] netfilter: nf_tables: reject mismatching sum of field_len with set key length https://git.kernel.org/netdev/net/c/1b9335a8000f You are awesome, thank you!
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c4af283356e7..e5662dc087c8 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5065,7 +5065,7 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr, static int nft_set_desc_concat(struct nft_set_desc *desc, const struct nlattr *nla) { - u32 num_regs = 0, key_num_regs = 0; + u32 len = 0, num_regs; struct nlattr *attr; int rem, err, i; @@ -5079,12 +5079,12 @@ static int nft_set_desc_concat(struct nft_set_desc *desc, } for (i = 0; i < desc->field_count; i++) - num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32)); + len += round_up(desc->field_len[i], sizeof(u32)); - key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); - if (key_num_regs != num_regs) + if (len != desc->klen) return -EINVAL; + num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32)); if (num_regs > NFT_REG32_COUNT) return -E2BIG;
The field length description provides the length of each separated key field in the concatenation, each field gets rounded up to 32-bits to calculate the pipapo rule width from pipapo_init(). The set key length provides the total size of the key aligned to 32-bits. Register-based arithmetics still allows for combining mismatching set key length and field length description, eg. set key length 10 and field description [ 5, 4 ] leading to pipapo width of 12. Cc: stable@vger.kernel.org Fixes: 3ce67e3793f4 ("netfilter: nf_tables: do not allow mismatch field size and set key length") Reported-by: Noam Rathaus <noamr@ssd-disclosure.com> Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_tables_api.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)