298977887/lede
1
0
Fork 0
mirror of https://github.com/coolsnowwolf/lede.git synced 2025-07-01 06:17:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

netfilter match bypass default check: fix in kernel 3.18 4.4 4.9

Browse Source
This commit is contained in:
coolsnowwolf 2017-10-27 11:32:38 +08:00
parent 457fcc005a
commit f364ed4360
3 changed files with 63 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
target/linux/generic/pending-3.18/610-netfilter_match_bypass_default_checks.patch
View File

@ -67,11 +67,10 @@
counters = alloc_counters(table); counters = alloc_counters(table);
if (IS_ERR(counters)) if (IS_ERR(counters))
@@ -972,6 +1001,14 @@ copy_entries_to_user(unsigned int total_ @@ -973,6 +1002,14 @@ copy_entries_to_user(unsigned int total_
ret = -EFAULT;
goto free_counters; goto free_counters;
} }
+
+ flags = e->ip.flags & IPT_F_MASK; + flags = e->ip.flags & IPT_F_MASK;
+ if (copy_to_user(userptr + off + if (copy_to_user(userptr + off
+ + offsetof(struct ipt_entry, ip.flags), + + offsetof(struct ipt_entry, ip.flags),
@ -79,6 +78,24 @@
+ ret = -EFAULT; + ret = -EFAULT;
+ goto free_counters; + goto free_counters;
+ } + }
+
for (i = sizeof(struct ipt_entry); for (i = sizeof(struct ipt_entry);
i < e->target_offset; i < e->target_offset;
i += m->u.match_size) {
@@ -1379,12 +1416,15 @@ compat_copy_entry_to_user(struct ipt_ent
compat_uint_t origsize;
const struct xt_entry_match *ematch;
int ret = 0;
+ u8 flags = e->ip.flags & IPT_F_MASK;
origsize = *size;
ce = (struct compat_ipt_entry __user *)*dstptr;
if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
copy_to_user(&ce->counters, &counters[i],
- sizeof(counters[i])) != 0)
+ sizeof(counters[i])) != 0 ||
+ copy_to_user(&ce->ip.flags, &flags,
+ sizeof(flags)) != 0)
return -EFAULT;
*dstptr += sizeof(struct compat_ipt_entry);

25
target/linux/generic/pending-4.4/610-netfilter_match_bypass_default_checks.patch
View File

@ -67,11 +67,10 @@
counters = alloc_counters(table); counters = alloc_counters(table);
if (IS_ERR(counters)) if (IS_ERR(counters))
@@ -974,6 +1003,14 @@ copy_entries_to_user(unsigned int total_ @@ -975,6 +1004,14 @@ copy_entries_to_user(unsigned int total_
ret = -EFAULT;
goto free_counters; goto free_counters;
} }
+
+ flags = e->ip.flags & IPT_F_MASK; + flags = e->ip.flags & IPT_F_MASK;
+ if (copy_to_user(userptr + off + if (copy_to_user(userptr + off
+ + offsetof(struct ipt_entry, ip.flags), + + offsetof(struct ipt_entry, ip.flags),
@ -79,6 +78,24 @@
+ ret = -EFAULT; + ret = -EFAULT;
+ goto free_counters; + goto free_counters;
+ } + }
+
for (i = sizeof(struct ipt_entry); for (i = sizeof(struct ipt_entry);
i < e->target_offset; i < e->target_offset;
i += m->u.match_size) {
@@ -1380,12 +1417,15 @@ compat_copy_entry_to_user(struct ipt_ent
compat_uint_t origsize;
const struct xt_entry_match *ematch;
int ret = 0;
+ u8 flags = e->ip.flags & IPT_F_MASK;
origsize = *size;
ce = (struct compat_ipt_entry __user *)*dstptr;
if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
copy_to_user(&ce->counters, &counters[i],
- sizeof(counters[i])) != 0)
+ sizeof(counters[i])) != 0 ||
+ copy_to_user(&ce->ip.flags, &flags,
+ sizeof(flags)) != 0)
return -EFAULT;
*dstptr += sizeof(struct compat_ipt_entry);

25
target/linux/generic/pending-4.9/610-netfilter_match_bypass_default_checks.patch
View File

@ -76,11 +76,10 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
counters = alloc_counters(table); counters = alloc_counters(table);
if (IS_ERR(counters)) if (IS_ERR(counters))
@@ -850,6 +879,14 @@ copy_entries_to_user(unsigned int total_ @@ -851,6 +880,14 @@ copy_entries_to_user(unsigned int total_
ret = -EFAULT;
goto free_counters; goto free_counters;
} }
+
+ flags = e->ip.flags & IPT_F_MASK; + flags = e->ip.flags & IPT_F_MASK;
+ if (copy_to_user(userptr + off + if (copy_to_user(userptr + off
+ + offsetof(struct ipt_entry, ip.flags), + + offsetof(struct ipt_entry, ip.flags),
@ -88,6 +87,24 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
+ ret = -EFAULT; + ret = -EFAULT;
+ goto free_counters; + goto free_counters;
+ } + }
+
for (i = sizeof(struct ipt_entry); for (i = sizeof(struct ipt_entry);
i < e->target_offset; i < e->target_offset;
i += m->u.match_size) {
@@ -1240,12 +1277,15 @@ compat_copy_entry_to_user(struct ipt_ent
compat_uint_t origsize;
const struct xt_entry_match *ematch;
int ret = 0;
+ u8 flags = e->ip.flags & IPT_F_MASK;
origsize = *size;
ce = (struct compat_ipt_entry __user *)*dstptr;
if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
copy_to_user(&ce->counters, &counters[i],
- sizeof(counters[i])) != 0)
+ sizeof(counters[i])) != 0 ||
+ copy_to_user(&ce->ip.flags, &flags,
+ sizeof(flags)) != 0)
return -EFAULT;
*dstptr += sizeof(struct compat_ipt_entry);