tree 12bd2de14e91cfd4a74739ea98668b2ed71dd623
parent 8119a2b42028c7ab722aad73cd21efd8c0e580e2
author Florian Westphal <fw@strlen.de> 1617824337 +0200
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1618566398 +0200

netfilter: x_tables: fix compat match/target pad out-of-bound write

commit b29c457a6511435960115c0f548c4360d5f4801d upstream.

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: syzbot+cfc0247ac173f597aaaa@syzkaller.appspotmail.com
Reported-by: Andy Nguyen <theflow@google.com>
Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>