]> git.hungrycats.org Git - linux/commit
ebtables: arpreply: Add the standard target sanity check
authorGao Feng <gfree.wind@vip.163.com>
Tue, 16 May 2017 01:30:18 +0000 (09:30 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 13 Oct 2018 07:09:32 +0000 (09:09 +0200)
commitab94214d643ed15ea0737db9c04c9c223201f346
treea7476c54164b064c2c811b0c7e1399e31aff16e2
parent72c6877269634ae6c70112c34c5961e6dd520799
ebtables: arpreply: Add the standard target sanity check

commit c953d63548207a085abcb12a15fefc8a11ffdf0a upstream.

The info->target comes from userspace and it would be used directly.
So we need to add the sanity check to make sure it is a valid standard
target, although the ebtables tool has already checked it. Kernel needs
to validate anything coming from userspace.

If the target is set as an evil value, it would break the ebtables
and cause a panic. Because the non-standard target is treated as one
offset.

Now add one helper function ebt_invalid_target, and we would replace
the macro INVALID_TARGET later.

Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Loic <hackurx@opensec.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/linux/netfilter_bridge/ebtables.h
net/bridge/netfilter/ebt_arpreply.c