netfilter: nf_tables: validate len in nft_validate_data_load()

For values spanning multiple registers, we need to validate that enough
space is available from the destination register onwards. Add a len
argument to nft_validate_data_load() and consolidate the existing length
validations in preparation of that.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

10 files changed, 97 insertions, 46 deletions

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index d6a2f0ed5130..f491243ff58b 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -116,7 +116,7 @@ int nft_validate_input_register(enum nft_registers reg);
 int nft_validate_output_register(enum nft_registers reg);
 int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
                            const struct nft_data *data,
-                           enum nft_data_types type);
+                           enum nft_data_types type, unsigned int len);
 
 
 /**
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 4f02109d708f..2011b89690f7 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -53,12 +53,14 @@ static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,
                                     const struct nlattr * const tb[])
 {
         struct nft_meta *priv = nft_expr_priv(expr);
+        unsigned int len;
         int err;
 
         priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
         switch (priv->key) {
         case NFT_META_BRI_IIFNAME:
         case NFT_META_BRI_OIFNAME:
+                len = IFNAMSIZ;
                 break;
         default:
                 return nft_meta_get_init(ctx, expr, tb);
@@ -69,7 +71,8 @@ static int nft_meta_bridge_get_init(const struct nft_ctx *ctx,
         if (err < 0)
                 return err;
 
-        err = nft_validate_data_load(ctx, priv->dreg, NULL, NFT_DATA_VALUE);
+        err = nft_validate_data_load(ctx, priv->dreg, NULL,
+                                     NFT_DATA_VALUE, len);
         if (err < 0)
                 return err;
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0b96fa0d64b2..564f9ed6680d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2799,7 +2799,8 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
         dreg = nft_type_to_reg(set->dtype);
         return nft_validate_data_load(ctx, dreg, nft_set_ext_data(ext),
                                       set->dtype == NFT_DATA_VERDICT ?
-                                      NFT_DATA_VERDICT : NFT_DATA_VALUE);
+                                      NFT_DATA_VERDICT : NFT_DATA_VALUE,
+                                      set->dlen);
 }
 
 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
@@ -3334,7 +3335,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                                 continue;
 
                         err = nft_validate_data_load(&bind_ctx, dreg,
-                                                     &data, d2.type);
+                                                     &data, d2.type, d2.len);
                         if (err < 0)
                                 goto err3;
                 }
@@ -4162,15 +4163,16 @@ EXPORT_SYMBOL_GPL(nft_validate_output_register);
  *      @reg: the destination register number
  *      @data: the data to load
  *      @type: the data type
+ *      @len: the length of the data
  *
  *      Validate that a data load uses the appropriate data type for
- *      the destination register. A value of NULL for the data means
- *      that its runtime gathered data, which is always of type
- *      NFT_DATA_VALUE.
+ *      the destination register and the length is within the bounds.
+ *      A value of NULL for the data means that its runtime gathered
+ *      data, which is always of type NFT_DATA_VALUE.
  */
 int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
                            const struct nft_data *data,
-                           enum nft_data_types type)
+                           enum nft_data_types type, unsigned int len)
 {
         int err;
 
@@ -4193,6 +4195,10 @@ int nft_validate_data_load(const struct nft_ctx *ctx, enum nft_registers reg,
 
                 return 0;
         default:
+                if (len == 0)
+                        return -EINVAL;
+                if (len > FIELD_SIZEOF(struct nft_data, data))
+                        return -ERANGE;
                 if (data != NULL && type != NFT_DATA_VALUE)
                         return -EINVAL;
                 return 0;
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index 4fb6ee2c1106..fcd951f24779 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -63,6 +63,8 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
             tb[NFTA_BITWISE_XOR] == NULL)
                 return -EINVAL;
 
+        priv->len = ntohl(nla_get_be32(tb[NFTA_BITWISE_LEN]));
+
         priv->sreg = ntohl(nla_get_be32(tb[NFTA_BITWISE_SREG]));
         err = nft_validate_input_register(priv->sreg);
         if (err < 0)
@@ -72,12 +74,12 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
         err = nft_validate_output_register(priv->dreg);
         if (err < 0)
                 return err;
-        err = nft_validate_data_load(ctx, priv->dreg, NULL, NFT_DATA_VALUE);
+
+        err = nft_validate_data_load(ctx, priv->dreg, NULL,
+                                     NFT_DATA_VALUE, priv->len);
         if (err < 0)
                 return err;
 
-        priv->len = ntohl(nla_get_be32(tb[NFTA_BITWISE_LEN]));
-
         err = nft_data_init(NULL, &priv->mask, &d1, tb[NFTA_BITWISE_MASK]);
         if (err < 0)
                 return err;
diff --git a/net/netfilter/nft_byteorder.c b/net/netfilter/nft_byteorder.c
index c39ed8d29df1..183f13308c94 100644
--- a/net/netfilter/nft_byteorder.c
+++ b/net/netfilter/nft_byteorder.c
@@ -87,19 +87,6 @@ static int nft_byteorder_init(const struct nft_ctx *ctx,
             tb[NFTA_BYTEORDER_OP] == NULL)
                 return -EINVAL;
 
-        priv->sreg = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_SREG]));
-        err = nft_validate_input_register(priv->sreg);
-        if (err < 0)
-                return err;
-
-        priv->dreg = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_DREG]));
-        err = nft_validate_output_register(priv->dreg);
-        if (err < 0)
-                return err;
-        err = nft_validate_data_load(ctx, priv->dreg, NULL, NFT_DATA_VALUE);
-        if (err < 0)
-                return err;
-
         priv->op = ntohl(nla_get_be32(tb[NFTA_BYTEORDER_OP]));
         switch (priv->op) {
         case NFT_BYTEORDER_NTOH:
@@ -122,6 +109,20 @@ static int nft_by