netfilter: nft_inner: validate mandatory meta and payload

Check for mandatory netlink attributes in payload and meta expression
when used embedded from the inner expression, otherwise NULL pointer
dereference is possible from userspace.

Fixes: a150d122b6bd ("netfilter: nft_meta: add inner match support")
Fixes: 3a07327d10a0 ("netfilter: nft_inner: support for inner tunnel header matching")
Signed-off-by: Davide Ornaghi <d.ornaghi97@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index ba0d3683a45d32aae8e7240b035c7facc604aea0..9139ce38ea7b9a7ed2cb626762ef5620e0124b52 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -839,6 +839,9 @@ static int nft_meta_inner_init(const struct nft_ctx *ctx,
        struct nft_meta *priv = nft_expr_priv(expr);
        unsigned int len;
 
+       if (!tb[NFTA_META_KEY] || !tb[NFTA_META_DREG])
+               return -EINVAL;
+
        priv->key = ntohl(nla_get_be32(tb[NFTA_META_KEY]));
        switch (priv->key) {
        case NFT_META_PROTOCOL:

diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 0c43d748e23ae1537eb9043e2209054584e4a352..50429cbd42da42928f585daddec4ffa5016588ad 100644 (file)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -650,6 +650,10 @@ static int nft_payload_inner_init(const struct nft_ctx *ctx,
        struct nft_payload *priv = nft_expr_priv(expr);
        u32 base;
 
+       if (!tb[NFTA_PAYLOAD_BASE] || !tb[NFTA_PAYLOAD_OFFSET] ||
+           !tb[NFTA_PAYLOAD_LEN] || !tb[NFTA_PAYLOAD_DREG])
+               return -EINVAL;
+
        base   = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE]));
        switch (base) {
        case NFT_PAYLOAD_TUN_HEADER: