Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
netfilter: ipset: fix checking the type revision at create command
The revision of the set type was not checked at the create command: if the
userspace sent a valid set type but with not supported revision number,
it'd create a loop.
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
authored by Jozsef Kadlecsik and committed by Patrick McHardy 5c1aba46 5e0c1eb7
+17
-5
net/netfilter/ipset/ip_set_core.c
+17
-5
net/netfilter/ipset/ip_set_core.c
···
94
find_set_type_get(const char *name, u8 family, u8 revision,
95
struct ip_set_type **found)
96
{
97
rcu_read_lock();
98
*found = find_set_type(name, family, revision);
99
if (*found) {
100
-
int err = !try_module_get((*found)->me);
101
-
rcu_read_unlock();
102
-
return err ? -EFAULT : 0;
103
}
104
rcu_read_unlock();
105
106
return try_to_load_type(name);
107
}
108
109
/* Find a given set type by name and family.
···
128
struct ip_set_type *type;
129
bool found = false;
130
131
-
*min = *max = 0;
132
rcu_read_lock();
133
list_for_each_entry_rcu(type, &ip_set_type_list, list)
134
if (STREQ(type->name, name) &&
···
136
found = true;
137
if (type->revision < *min)
138
*min = type->revision;
139
-
else if (type->revision > *max)
140
*max = type->revision;
141
}
142
rcu_read_unlock();
···
94
find_set_type_get(const char *name, u8 family, u8 revision,
95
struct ip_set_type **found)
96
{
97
+
struct ip_set_type *type;
98
+
int err;
99
+
100
rcu_read_lock();
101
*found = find_set_type(name, family, revision);
102
if (*found) {
103
+
err = !try_module_get((*found)->me) ? -EFAULT : 0;
104
+
goto unlock;
105
}
106
+
/* Make sure the type is loaded but we don't support the revision */
107
+
list_for_each_entry_rcu(type, &ip_set_type_list, list)
108
+
if (STREQ(type->name, name)) {
109
+
err = -IPSET_ERR_FIND_TYPE;
110
+
goto unlock;
111
+
}
112
rcu_read_unlock();
113
114
return try_to_load_type(name);
115
+
116
+
unlock:
117
+
rcu_read_unlock();
118
+
return err;
119
}
120
121
/* Find a given set type by name and family.
···
116
struct ip_set_type *type;
117
bool found = false;
118
119
+
*min = 255; *max = 0;
120
rcu_read_lock();
121
list_for_each_entry_rcu(type, &ip_set_type_list, list)
122
if (STREQ(type->name, name) &&
···
124
found = true;
125
if (type->revision < *min)
126
*min = type->revision;
127
+
if (type->revision > *max)
128
*max = type->revision;
129
}
130
rcu_read_unlock();