evaluate: error out when store needs more than one 128bit register of align fixup

Else this gives:
nft: evaluate.c:2983: stmt_evaluate_payload: Assertion `sizeof(data) * BITS_PER_BYTE >= masklen' failed.

For loads, this is already prevented via expr_evaluate_bits() which has:

  if (masklen > NFT_REG_SIZE * BITS_PER_BYTE)
      return expr_error(ctx->msgs, expr, "mask length %u exceeds allowed maximum of %u\n",
                        masklen, NFT_REG_SIZE * BITS_PER_BYTE);

But for the store path this isn't called.
The reproducer asks to store a 128 bit integer at bit offset 1, i.e.
17 bytes would need to be munged, but we can only handle up to 16 bytes
(one pseudo-register).

Fixes: 78936d50f306 ("evaluate: add support to set IPv6 non-byte header fields")
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/src/evaluate.c b/src/evaluate.c
index 3b3661669b306c3e4403f7285ad75dd9f5a679d2..68cfd77653813fe23b0110ca5a6ca716641e2bcb 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3188,6 +3188,11 @@ static int stmt_evaluate_payload(struct eval_ctx *ctx, struct stmt *stmt)
        payload_byte_size = div_round_up(payload->len + extra_len,
                                         BITS_PER_BYTE);
 
+       if (payload_byte_size > sizeof(data))
+               return expr_error(ctx->msgs, stmt->payload.expr,
+                                 "uneven load cannot span more than %u bytes, got %u",
+                                 sizeof(data), payload_byte_size);
+
        if (need_csum && payload_byte_size & 1) {
                payload_byte_size++;
 

diff --git a/tests/shell/testcases/bogons/nft-f/payload_expr_unaligned_store b/tests/shell/testcases/bogons/nft-f/payload_expr_unaligned_store
new file mode 100644 (file)
index 0000000..c1358df
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-f/payload_expr_unaligned_store
@@ -0,0 +1 @@
+add rule f i @th,1,128 set 1