]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: xt_RATEEST: reject non-null terminated string from userspace
authorFlorian Westphal <fw@strlen.de>
Tue, 22 Dec 2020 22:23:56 +0000 (23:23 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 12 Jan 2021 19:16:24 +0000 (20:16 +0100)
commit5e401ea71676bd7c82ce44eb663fec7678ccffdd
tree8502275e49f84a1dc5790c4d3fdf7a04b4c09dde
parent1dd6a790c22063caf3b2b4eb8376ce0625cbc8cd
netfilter: xt_RATEEST: reject non-null terminated string from userspace

commit 6cb56218ad9e580e519dcd23bfb3db08d8692e5a upstream.

syzbot reports:
detected buffer overflow in strlen
[..]
Call Trace:
 strlen include/linux/string.h:325 [inline]
 strlcpy include/linux/string.h:348 [inline]
 xt_rateest_tg_checkentry+0x2a5/0x6b0 net/netfilter/xt_RATEEST.c:143

strlcpy assumes src is a c-string. Check info->name before its used.

Reported-by: syzbot+e86f7c428c8c50db65b4@syzkaller.appspotmail.com
Fixes: 5859034d7eb8793 ("[NETFILTER]: x_tables: add RATEEST target")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/netfilter/xt_RATEEST.c