From patchwork Mon Nov 15 06:15:49 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Changli Gao X-Patchwork-Id: 71178 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 41E15B7110 for ; Mon, 15 Nov 2010 17:16:29 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754250Ab0KOGQW (ORCPT ); Mon, 15 Nov 2010 01:16:22 -0500 Received: from mail-yw0-f46.google.com ([209.85.213.46]:37993 "EHLO mail-yw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754154Ab0KOGQV (ORCPT ); Mon, 15 Nov 2010 01:16:21 -0500 Received: by ywc21 with SMTP id 21so1527761ywc.19 for ; Sun, 14 Nov 2010 22:16:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:subject:date :message-id:x-mailer; bh=E0P26H/b3JxIV5v+MR0gKPIMpCfNACIFGXTiaiAK3gc=; b=cTlCm1/SedaKQf6yZfgDvc1qMDmEOIBpGGFxuTV/xklUMFJLf03tNX+D9lVpRBRQT7 ZnjM+52v6ZW0aC+Uj+wmMNaQFogwHqheppn/zUrOrpg9svEj6An9IVTiFW+iDxVGYuTR 9Y/pbuABPWoKSu1mTMESPVMrPejcI0UDY7ga8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=ZE/DpZaHMTFaqPk1bbDK9eXHjW9K4hQrU/odPup9Ve16W33JfMHDTtfJbqwSR86Jjv Wfc3e/sOjYFD1uuszN+wdhq5kqAgk/BA/T55zp8RNVFzYBL5Pe793DZTOb+LLiCRNdzK hCyebm4EHy234zaFYCX2qazAssJSdTMALGZRs= Received: by 10.150.134.21 with SMTP id h21mr8662506ybd.174.1289801780861; Sun, 14 Nov 2010 22:16:20 -0800 (PST) Received: from localhost.localdomain ([221.239.34.230]) by mx.google.com with ESMTPS id p30sm2874411ybk.20.2010.11.14.22.16.05 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sun, 14 Nov 2010 22:16:19 -0800 (PST) From: Changli Gao To: Patrick McHardy Cc: "David S. Miller" , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, Changli Gao Subject: [PATCH] netfilter: guard the size of the nf_ct_ext Date: Mon, 15 Nov 2010 14:15:49 +0800 Message-Id: <1289801749-8993-1-git-send-email-xiaosuo@gmail.com> X-Mailer: git-send-email 1.7.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org We'd better guard the size of the nf_ct_ext, as the nf_ct_ext.len is u8. If the size is bigger than 255, a warning will be printed. Signed-off-by: Changli Gao --- net/netfilter/nf_conntrack_extend.c | 41 +++++++++++++++++++++++++++++------- 1 file changed, 34 insertions(+), 7 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c index bd82450..6a404f9 100644 --- a/net/netfilter/nf_conntrack_extend.c +++ b/net/netfilter/nf_conntrack_extend.c @@ -8,6 +8,7 @@ * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. */ +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include #include @@ -98,6 +99,11 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp) newlen = newoff + t->len; rcu_read_unlock(); + if (unlikely(newlen > 255)) { + pr_warn_ratelimited("the size of nf_ct_ext is %d, " + "bigger than 255\n", newlen); + return NULL; + } new = __krealloc(old, newlen, gfp); if (!new) return NULL; @@ -125,9 +131,9 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp) } EXPORT_SYMBOL(__nf_ct_ext_add); -static void update_alloc_size(struct nf_ct_ext_type *type) +static bool update_alloc_size(struct nf_ct_ext_type *type) { - int i, j; + int i, j, alloc_size; struct nf_ct_ext_type *t1, *t2; enum nf_ct_ext_id min = 0, max = NF_CT_EXT_NUM - 1; @@ -153,16 +159,24 @@ static void update_alloc_size(struct nf_ct_ext_type *type) (t2->flags & NF_CT_EXT_F_PREALLOC) == 0) continue; - t1->alloc_size = ALIGN(t1->alloc_size, t2->align) - + t2->len; + alloc_size = ALIGN(t1->alloc_size, t2->align) + t2->len; + if (unlikely(alloc_size > 255)) { + pr_warn("the size of nf_ct_ext is %d, " + "bigger than 255\n", alloc_size); + return false; + } + t1->alloc_size = alloc_size; } } + + return true; } /* This MUST be called in process context. */ int nf_ct_extend_register(struct nf_ct_ext_type *type) { int ret = 0; + int alloc_size; mutex_lock(&nf_ct_ext_type_mutex); if (nf_ct_ext_types[type->id]) { @@ -172,13 +186,26 @@ int nf_ct_extend_register(struct nf_ct_ext_type *type) /* This ensures that nf_ct_ext_create() can allocate enough area before updating alloc_size */ - type->alloc_size = ALIGN(sizeof(struct nf_ct_ext), type->align) - + type->len; + alloc_size = ALIGN(sizeof(struct nf_ct_ext), type->align) + type->len; + if (unlikely(alloc_size > 255)) { + pr_warn("the size of nf_ct_ext is %d, bigger than 255\n", + alloc_size); + ret = -EINVAL; + goto out; + } + type->alloc_size = alloc_size; rcu_assign_pointer(nf_ct_ext_types[type->id], type); - update_alloc_size(type); + if (!update_alloc_size(type)) + goto err; out: mutex_unlock(&nf_ct_ext_type_mutex); return ret; +err: + rcu_assign_pointer(nf_ct_ext_types[type->id], NULL); + update_alloc_size(type); + mutex_unlock(&nf_ct_ext_type_mutex); + rcu_barrier(); + return -EINVAL; } EXPORT_SYMBOL_GPL(nf_ct_extend_register);