]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 8655473) | patch
netfilter: nf_tables: add __nft_chain_type_get()
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 21 Jan 2020 15:07:00 +0000 (16:07 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 24 Jan 2020 19:54:28 +0000 (20:54 +0100)
commite19822cb35cb287a69b3280a5a901dec06bed5c4
tree22dcb670215ae5c943d1fcd2ba8780bb1dbca885tree | snapshot
parent86554738dbfdb7afb51df7b4bbc04b2211b5e2c5commit | diff
netfilter: nf_tables: add __nft_chain_type_get()

This new helper function validates that unknown family and chain type
coming from userspace do not trigger an out-of-bound array access. Bail
out in case __nft_chain_type_get() returns NULL from
nft_chain_parse_hook().

Fixes: e46bf4a543f0 ("netfilter: nf_tables: convert built-in tables/chains to chain types")
Reported-by: syzbot+156a04714799b1d480bc@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c diff | blob | history
Linux Kernel Source Tree.