tree 6e09f3dd34aa4c2ed13b31ac5e31f8b0c6072069
parent c409014c90e96644c5d326df00c05a937ad998a2
author Ke Wu <mikewu@google.com> 1618570810 -0700
committer Arnav Kansal <rnv@google.com> 1618946156 +0000

netfilter: x_tables: fix compat match/target pad out-of-bound write

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
Reported-by: Andy Nguyen <theflow@google.com>
Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: Florian Westphal <fw@strlen.de>

BUG=b/184972413
TEST=Presubmit test
RELEASE_NOTE=Fixd an issue in kernel that netfilter/x_tables.c
may cause out-of-bound write
SOURCE=FROMLIST(https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210407193857.21120-1-fw@strlen.de/)
cos-patch: security-high

Change-Id: I2752c7c9eb17d48790adb6cebd0a7824b2c9f414
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/15631
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Roy Yang <royyang@google.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
(cherry picked from commit b6bcfb87a592c722322cd0907f59b0c019af70e7)
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/15790
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Tested-by: Robert Kolchmeyer <rkolchmeyer@google.com>