From patchwork Fri Sep 20 10:21:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Massimiliano Pellizzer X-Patchwork-Id: 1987872 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4X97hq28Kfz1y2j for ; Fri, 20 Sep 2024 20:21:30 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1sralO-0005Wj-1i; Fri, 20 Sep 2024 10:21:22 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1sralK-0005UV-2k for kernel-team@lists.ubuntu.com; Fri, 20 Sep 2024 10:21:18 +0000 Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 8B0AA40A84 for ; Fri, 20 Sep 2024 10:21:16 +0000 (UTC) Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-a8d21b5cb5fso107557766b.0 for ; Fri, 20 Sep 2024 03:21:16 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1726827676; x=1727432476; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=xW7n2xUMuQiutbPmG2taTp7+tjyZ5hJR+t9OGgeE5OA=; b=Cr3KxAjeh1qgo4Y3S5AJkn1Jc0133JvX+Anp1Z8uROdyU3PBrE47pkwuy017Z5VWd1 Iz6s6nXiOmmEBeThSnBePu97oO0GspTfzaQEQBmOqO2JSAdynqoGsinKrDYIKY1T9cp4 QfJPGWvONjLsaoGjfKd3P2+BYCPAOKlfbDJB2my2zYEWbiiwZ3Pv1l6gf6B2Pt6Yap7L Vf4yLFveXvMhuGuIYp1urG6yAZQtWFXf46SwhbhQ2z+qBpYC7jJeI4FfRDAXsSN/rCk9 LldR3UsHc0U/UCeLk+wCm7NTvzqvb0xiypWUC1GoGsSUCOs331Q9DC87q/A5hCYzCHQn 2LMg== X-Gm-Message-State: AOJu0Ywd0gd5zi1dT6QVwYYAPMQSCau0XHQ21/4+1EhirVRKEAA9p2LZ N9y63euJjEDP3dOS0buL529OqAki7XkIdSqP9fHZlULmyUlnC108IPVv9vMy00nNNMzhUTAoU+3 EmF3XcuHMOd6vDG8K3IFWiMWewdLY8aaOf3mghByUs7vuYodNL3ilEnWkYwns0/0HLKNT5y4n38 3owvcPROcBew== X-Received: by 2002:a17:907:94d4:b0:a8b:6ee7:ba1b with SMTP id a640c23a62f3a-a90d56d8d57mr178383366b.15.1726827675775; Fri, 20 Sep 2024 03:21:15 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFX4RJgv+vIUF3dzXlpA4CcKuREZRAmT0OFHnpkkVcrrkUuTaOPEA0zmmuThWoqlgYotpQTUw== X-Received: by 2002:a17:907:94d4:b0:a8b:6ee7:ba1b with SMTP id a640c23a62f3a-a90d56d8d57mr178380566b.15.1726827675271; Fri, 20 Sep 2024 03:21:15 -0700 (PDT) Received: from framework-canonical.station (net-93-71-67-182.cust.vodafonedsl.it. [93.71.67.182]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a90610f388esm829104766b.63.2024.09.20.03.21.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Sep 2024 03:21:14 -0700 (PDT) From: Massimiliano Pellizzer To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH 2/2] netfilter: nft_limit: reject configurations that cause integer overflow Date: Fri, 20 Sep 2024 12:21:00 +0200 Message-ID: <20240920102100.36974-3-massimiliano.pellizzer@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240920102100.36974-1-massimiliano.pellizzer@canonical.com> References: <20240920102100.36974-1-massimiliano.pellizzer@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Florian Westphal [ Upstream commit c9d9eb9c53d37cdebbad56b91e40baf42d5a97aa ] Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this rather than having incorrect ratelimit. Fixes: d2168e849ebf ("netfilter: nft_limit: add per-byte limiting") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin (backported from commit 79d4efd75e7dbecd855a3b8a63e65f7265f466e1 linux-5.15.y) [mpellizzer: backported solving a conflict due to a variable declaration which does not affect the patch, and casting some variables and constants since the versions of check_mul_overflow and check_add_overflow used expect the arguments to have the same type] CVE-2024-26668 Signed-off-by: Massimiliano Pellizzer --- net/netfilter/nft_limit.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c index cddb5e8c4595..ca168c4bbff4 100644 --- a/net/netfilter/nft_limit.c +++ b/net/netfilter/nft_limit.c @@ -54,16 +54,18 @@ static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost) static int nft_limit_init(struct nft_limit_priv *priv, const struct nlattr * const tb[], bool pkts) { - u64 unit, tokens; + u64 unit, tokens, rate_with_burst; if (tb[NFTA_LIMIT_RATE] == NULL || tb[NFTA_LIMIT_UNIT] == NULL) return -EINVAL; priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE])); + if (priv->rate == 0) + return -EINVAL; + unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT])); - priv->nsecs = unit * NSEC_PER_SEC; - if (priv->rate == 0 || priv->nsecs < unit) + if (check_mul_overflow(unit, (u64)NSEC_PER_SEC, &priv->nsecs)) return -EOVERFLOW; if (tb[NFTA_LIMIT_BURST]) @@ -72,18 +74,25 @@ static int nft_limit_init(struct nft_limit_priv *priv, if (pkts && priv->burst == 0) priv->burst = NFT_LIMIT_PKT_BURST_DEFAULT; - if (priv->rate + priv->burst < priv->rate) + if (check_add_overflow(priv->rate, (u64)priv->burst, &rate_with_burst)) return -EOVERFLOW; if (pkts) { - tokens = div64_u64(priv->nsecs, priv->rate) * priv->burst; + u64 tmp = div64_u64(priv->nsecs, priv->rate); + + if (check_mul_overflow(tmp, (u64)priv->burst, &tokens)) + return -EOVERFLOW; } else { + u64 tmp; + /* The token bucket size limits the number of tokens can be * accumulated. tokens_max specifies the bucket size. * tokens_max = unit * (rate + burst) / rate. */ - tokens = div64_u64(priv->nsecs * (priv->rate + priv->burst), - priv->rate); + if (check_mul_overflow(priv->nsecs, rate_with_burst, &tmp)) + return -EOVERFLOW; + + tokens = div64_u64(tmp, priv->rate); } priv->tokens = tokens;