Will McVicker
289fe546ea
netfilter: ctnetlink: add a range check for l3/l4 protonum ...
commit 1cc5ef91d2ff94d2bf2de3b3585423e8a1051cb6 upstream.
The indexes to the nf_nat_l[34]protos arrays come from userspace. So
check the tuple's family, e.g. l3num, when creating the conntrack in
order to prevent an OOB memory access during setup. Here is an example
kernel panic on 4.14.180 when userspace passes in an index greater than
NFPROTO_NUMPROTO.
Internal error: Oops - BUG: 0 [#1 ] PREEMPT SMP
Modules linked in:...
Process poc (pid: 5614, stack limit = 0x00000000a3933121)
CPU: 4 PID: 5614 Comm: poc Tainted: G S W O 4.14.180-g051355490483
Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM
task: 000000002a3dfffe task.stack: 00000000a3933121
pc : __cfi_check_fail+0x1c/0x24
lr : __cfi_check_fail+0x1c/0x24
...
Call trace:
__cfi_check_fail+0x1c/0x24
name_to_dev_t+0x0/0x468
nfnetlink_parse_nat_setup+0x234/0x258
ctnetlink_parse_nat_setup+0x4c/0x228
ctnetlink_new_conntrack+0x590/0xc40
nfnetlink_rcv_msg+0x31c/0x4d4
netlink_rcv_skb+0x100/0x184
nfnetlink_rcv+0xf4/0x180
netlink_unicast+0x360/0x770
netlink_sendmsg+0x5a0/0x6a4
___sys_sendmsg+0x314/0x46c
SyS_sendmsg+0xb4/0x108
el0_svc_naked+0x34/0x38
This crash is not happening since 5.4+, however, ctnetlink still
allows for creating entries with unsupported layer 3 protocol number.
Fixes: c1d10adb4a
2020-10-07 08:00:09 +02:00
6lowpan: Off by one handling ->nexthdr
2020-01-27 14:50:41 +01:00
net/9p: validate fds in p9_fd_open
2020-08-11 15:32:32 +02:00
vlan: vlan_changelink() should propagate errors
2020-01-12 12:17:28 +01:00
appletalk: Set error code if register_snap_client failed
2019-12-13 08:52:59 +01:00
atm: fix a memory leak of vcc->user_back
2020-10-01 13:14:43 +02:00
AX.25: Prevent integer overflows in connect and sendmsg
2020-07-31 18:37:48 +02:00
batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
2020-10-01 13:14:52 +02:00
Bluetooth: Handle Inquiry Cancel error after Inquiry Complete
2020-10-01 13:14:44 +02:00
bpf/test_run: support cgroup local storage
2018-08-03 00:47:32 +02:00
signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig
2020-01-27 14:50:51 +01:00
net: bridge: enfore alignment for ethernet address
2020-06-30 23:17:03 -04:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
can: gw: Fix error path of cgw_module_init
2019-08-29 08:28:30 +02:00
libceph: don't omit recovery_deletes in target_copy()
2020-07-22 09:32:13 +02:00
bpf: Fix clobbering of r2 in bpf_gen_ld_abs
2020-10-01 13:14:52 +02:00
net: DCB: Validate DCB_ATTR_DCB_BUFFER argument
2020-09-26 18:01:29 +02:00
net: ipv6: add net argument to ip6_dst_lookup_flow
2020-04-29 16:31:16 +02:00
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2020-01-04 19:13:37 +01:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:30:24 +02:00
dsa: Allow forwarding of redirected IGMP traffic
2020-09-23 12:10:56 +02:00
net: add annotations on hh->hh_len lockless accesses
2020-01-09 10:19:09 +01:00
hsr: check protocol version in hsr_newlink()
2020-04-21 09:03:03 +02:00
nl802154: add missing attribute validation for dev_type
2020-03-18 07:14:15 +01:00
rt_cpu_seq_next should increase position index
2020-10-01 13:14:29 +02:00
ipv6_route_seq_next should increase position index
2020-10-01 13:14:29 +02:00
net/af_iucv: always register net_device notifier
2020-01-27 14:50:56 +01:00
kcm: switch order of device registration to fix a crash
2019-04-17 08:38:40 +02:00
af_key: pfkey_dump needs parameter validation
2020-09-26 18:01:28 +02:00
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
2020-07-22 09:31:59 +02:00
lapb: fixed leak of control-blocks.
2019-06-22 08:15:13 +02:00
net: silence data-races on sk_backlog.tail
2020-10-01 13:14:26 +02:00
mac80211: do not allow bigger VHT MPDUs than the hardware supports
2020-10-07 08:00:07 +02:00
mac802154: tx: fix use-after-free
2020-10-01 13:14:51 +02:00
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
2020-04-29 16:31:17 +02:00
net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler
2018-08-22 21:39:08 -07:00
netfilter: ctnetlink: add a range check for l3/l4 protonum
2020-10-07 08:00:09 +02:00
netlabel: fix problems with mapping removal
2020-09-12 13:40:22 +02:00
genetlink: remove genl_bind
2020-07-22 09:31:58 +02:00
net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
2020-04-29 16:31:21 +02:00
net/nfc/rawsock.c: add CAP_NET_RAW check.
2020-08-19 08:15:03 +02:00
nsh: set mac len based on inner packet
2018-07-12 16:55:29 -07:00
net: openvswitch: use div_u64() for 64-by-32 divisions
2020-10-01 13:14:49 +02:00
net/packet: fix overflow in tpacket_rcv
2020-10-07 08:00:08 +02:00
net: use skb_queue_empty_lockless() in poll() handlers
2019-11-10 11:27:48 +01:00
net: psample: fix skb_over_panic
2019-12-05 09:21:30 +01:00
net: qrtr: check skb_put_padto() return value
2020-09-26 18:01:30 +02:00
rds: Prevent kernel-infoleak in rds_notify_queue_get()
2020-08-05 10:06:01 +02:00
rfkill: Fix incorrect check to avoid NULL pointer dereference
2020-01-12 12:17:17 +01:00
net/rose: fix unbound loop in rose_loopback_timer()
2019-05-02 09:59:00 +02:00
rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
2020-08-11 15:32:35 +02:00
net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc
2020-09-26 18:01:30 +02:00
sctp: move trace_sctp_probe_path into sctp_outq_sack
2020-10-01 13:14:30 +02:00
net/smc: Prevent kernel-infoleak in __smc_diag_dump()
2020-09-03 11:24:17 +02:00
net: strparser: partially revert "strparser: Call skb_unclone conditionally"
2019-05-16 19:41:27 +02:00
svcrdma: Fix leak of transport addresses
2020-10-01 13:14:40 +02:00
tipc: fix memory leak in service subscripting
2020-10-01 13:14:44 +02:00
net/tls: Fix kmap usage
2020-08-19 08:15:03 +02:00
skbuff: fix a data race in skb_queue_len()
2020-10-01 13:14:32 +02:00
net: virtio_vsock: Enhance connection semantics
2020-10-07 08:00:05 +02:00
wimax: remove blank lines at EOF
2018-07-24 14:10:42 -07:00
cfg80211: regulatory: reject invalid hints
2020-09-09 19:04:32 +02:00
net/x25: Fix null-ptr-deref in x25_disconnect
2020-08-05 10:06:02 +02:00
xdp: Fix xsk_generic_xmit errno
2020-06-25 15:33:05 +02:00
xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
2020-06-30 23:17:10 -04:00
net/compat: Add missing sock updates for SCM_RIGHTS
2020-08-21 11:05:32 +02:00
net: remove blank lines at end of file
2018-07-24 14:10:43 -07:00
bpfilter: check compiler capability in Kconfig
2018-06-28 13:36:39 +09:00
net: Set fput_needed iff FDPUT_FPUT is set
2020-08-19 08:15:03 +02:00
289fe546ea