Re: [PATCH net] netfilter: xt_hashlimit: do not allow empty names
From: Eric Dumazet <hidden>
Date: 2018-01-28 17:54:09
Also in:
netfilter-devel
On Sun, 2018-01-28 at 07:41 -0800, Eric Dumazet wrote:
From: Eric Dumazet <edumazet@google.com> Syzbot reported a WARN() in proc_create_data() [1] Issue here is that xt_hashlimit does not check that user space provided an empty table name.
quoted hunk ↗ jump to hunk
Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <redacted> --- net/netfilter/xt_hashlimit.c | 2 ++ 1 file changed, 2 insertions(+)diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c index 5da8746f7b88ff4c9446f256e542e823a6a561b0..eae732e013df92a364b500645360d4606c283a75 100644 --- a/net/netfilter/xt_hashlimit.c +++ b/net/netfilter/xt_hashlimit.c@@ -894,6 +894,8 @@ static int hashlimit_mt_check_common(const struct xt_mtchk_param *par, return -ERANGE; } + if (!name[0]) + return -EINVAL; mutex_lock(&hashlimit_mutex); *hinfo = htable_find_get(net, name, par->family); if (*hinfo == NULL) {
I wonder if we should also check if name includes a '/' ?
if (!name[0] || strchr(name, '/'))
return -EINVAL;