GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-30 19:06:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

netfilter: nf_tables: remove VLA usage

Browse source 
In preparation to enabling -Wvla, remove VLA and replace it
with dynamic memory allocation.

>From a security viewpoint, the use of Variable Length Arrays can be
a vector for stack overflow attacks. Also, in general, as the code
evolves it is easy to lose track of how big a VLA can get. Thus, we
can end up having segfaults that are hard to debug.

Also, fixed as part of the directive to remove all VLAs from
the kernel: https://lkml.org/lkml/2018/3/7/621

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Gustavo A. R. Silva 2018-03-12 22:16:17 -05:00 • committed by Pablo Neira Ayuso
parent 1446385904
commit 5b4c6e3860
1 changed files with 15 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

23
net/netfilter/nf_tables_api.c
View file

@ -4357,16 +4357,20 @@ static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
const struct nft_object_type *type, const struct nft_object_type *type,
const struct nlattr *attr) const struct nlattr *attr)
{ {
struct nlattr *tb[type->maxattr + 1]; struct nlattr **tb;
const struct nft_object_ops *ops; const struct nft_object_ops *ops;
struct nft_object *obj; struct nft_object *obj;
int err; int err = -ENOMEM;
tb = kmalloc_array(type->maxattr + 1, sizeof(*tb), GFP_KERNEL);
if (!tb)
goto err1;
if (attr) { if (attr) {
err = nla_parse_nested(tb, type->maxattr, attr, type->policy, err = nla_parse_nested(tb, type->maxattr, attr, type->policy,
NULL); NULL);
if (err < 0) if (err < 0)
goto err1; goto err2;
} else { } else {
memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1)); memset(tb, 0, sizeof(tb[0]) * (type->maxattr + 1));
} }
@ -4375,7 +4379,7 @@ static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
ops = type->select_ops(ctx, (const struct nlattr * const *)tb); ops = type->select_ops(ctx, (const struct nlattr * const *)tb);
if (IS_ERR(ops)) { if (IS_ERR(ops)) {
err = PTR_ERR(ops); err = PTR_ERR(ops);
goto err1; goto err2;
} }
} else { } else {
ops = type->ops; ops = type->ops;
@ -4383,18 +4387,21 @@ static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
err = -ENOMEM; err = -ENOMEM;
obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL); obj = kzalloc(sizeof(*obj) + ops->size, GFP_KERNEL);
if (obj == NULL) if (!obj)
goto err1; goto err2;
err = ops->init(ctx, (const struct nlattr * const *)tb, obj); err = ops->init(ctx, (const struct nlattr * const *)tb, obj);
if (err < 0) if (err < 0)
goto err2; goto err3;
obj->ops = ops; obj->ops = ops;
kfree(tb);
return obj; return obj;
err2: err3:
kfree(obj); kfree(obj);
err2:
kfree(tb);
err1: err1:
return ERR_PTR(err); return ERR_PTR(err);
} }