Willem de Bruijn 324318f024 netfilter: xtables: zero padding in data_to_user ... When looking up an iptables rule, the iptables binary compares the aligned match and target data (XT_ALIGN). In some cases this can exceed the actual data size to include padding bytes. Before commit f77bc5b23f ("iptables: use match, target and data copy_to_user helpers") the malloc()ed bytes were overwritten by the kernel with kzalloced contents, zeroing the padding and making the comparison succeed. After this patch, the kernel copies and clears only data, leaving the padding bytes undefined. Extend the clear operation from data size to aligned data size to include the padding bytes, if any. Padding bytes can be observed in both match and target, and the bug triggered, by issuing a rule with match icmp and target ACCEPT: iptables -t mangle -A INPUT -i lo -p icmp --icmp-type 1 -j ACCEPT iptables -t mangle -D INPUT -i lo -p icmp --icmp-type 1 -j ACCEPT Fixes: f77bc5b23f ("iptables: use match, target and data copy_to_user helpers") Reported-by: Paul Moore <pmoore@redhat.com> Reported-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2017-05-15 12:51:38 +02:00
..
netfilter	netfilter: xtables: zero padding in data_to_user	2017-05-15 12:51:38 +02:00
br_device.c	bridge: move bridge multicast cleanup to ndo_uninit	2017-04-25 14:02:39 -04:00
br_fdb.c	net: bridge: Fix improper taking over HW learned FDB	2017-04-30 22:46:32 -04:00
br_forward.c	bridge: add per-port broadcast flood flag	2017-04-27 16:34:29 -04:00
br_if.c	bridge: add per-port broadcast flood flag	2017-04-27 16:34:29 -04:00
br_input.c
br_ioctl.c
br_mdb.c	net: rtnetlink: plumb extended ack to doit function	2017-04-17 15:35:38 -04:00
br_multicast.c
br_netfilter_hooks.c
br_netfilter_ipv6.c
br_netlink_tunnel.c
br_netlink.c	bridge: netlink: account for IFLA_BRPORT_{B, M}CAST_FLOOD size and policy	2017-05-05 11:21:03 -04:00
br_nf_core.c
br_private_stp.h
br_private_tunnel.h
br_private.h
br_stp_bpdu.c
br_stp_if.c
br_stp_timer.c
br_stp.c
br_switchdev.c
br_sysfs_br.c
br_sysfs_if.c	bridge: add per-port broadcast flood flag	2017-04-27 16:34:29 -04:00
br_vlan_tunnel.c
br_vlan.c
br.c
Kconfig
Makefile