netfilter: x_tables: add counters allocation wrapper

commit c84ca954ac9fa67a6ce27f91f01e4451c74fd8f6 upstream.

allows to have size checks in a single spot.
This is supposed to reduce oom situations when fuzz-testing xtables.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 14529511c4b8466ab81986ee9d874538bbe0e09a..470ca2be53466b7daa2822df04ac18931afa130a 100644 (file)
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -301,6 +301,7 @@ int xt_data_to_user(void __user *dst, const void *src,
 
 void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                                 struct xt_counters_info *info, bool compat);
+struct xt_counters *xt_counters_alloc(unsigned int counters);
 
 struct xt_table *xt_register_table(struct net *net,
                                   const struct xt_table *table,

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index e3e420f3ba7b2de96be867912695efb3ae2b193c..b7b9781b52d9ed1463563e0b05c253e0b6d1d2cc 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -895,7 +895,7 @@ static int __do_replace(struct net *net, const char *name,
        struct arpt_entry *iter;
 
        ret = 0;
-       counters = vzalloc(num_counters * sizeof(struct xt_counters));
+       counters = xt_counters_alloc(num_counters);
        if (!counters) {
                ret = -ENOMEM;
                goto out;

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index e38395a8dcf2806677cde272f72b3809c4f404a8..30726346f8b023356c88689e3b7ff0eb3f7f14e8 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1057,7 +1057,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        struct ipt_entry *iter;
 
        ret = 0;
-       counters = vzalloc(num_counters * sizeof(struct xt_counters));
+       counters = xt_counters_alloc(num_counters);
        if (!counters) {
                ret = -ENOMEM;
                goto out;

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 62358b93bbac5250676a067464c11e4e3d649faa..134d97aa71d0440e5004737a9c674348f9e41b2a 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1075,7 +1075,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        struct ip6t_entry *iter;
 
        ret = 0;
-       counters = vzalloc(num_counters * sizeof(struct xt_counters));
+       counters = xt_counters_alloc(num_counters);
        if (!counters) {
                ret = -ENOMEM;
                goto out;

diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 63b1f69c72ac28c98b01d4bed2b6ca53e0a0a63d..4089a9846d256d68295edad6086c4de3cdae4d6f 100644 (file)
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1199,6 +1199,21 @@ static int xt_jumpstack_alloc(struct xt_table_info *i)
        return 0;
 }
 
+struct xt_counters *xt_counters_alloc(unsigned int counters)
+{
+       struct xt_counters *mem;
+
+       if (counters == 0 || counters > INT_MAX / sizeof(*mem))
+               return NULL;
+
+       counters *= sizeof(*mem);
+       if (counters > XT_MAX_TABLE_SIZE)
+               return NULL;
+
+       return vzalloc(counters);
+}
+EXPORT_SYMBOL(xt_counters_alloc);
+
 struct xt_table_info *
 xt_replace_table(struct xt_table *table,
              unsigned int num_counters,