summaryrefslogtreecommitdiff
path: root/net/netfilter/nfnetlink_acct.c
diff options
context:
space:
mode:
authorPhil Turnbull <phil.turnbull@oracle.com>2016-02-24 15:34:43 -0500
committerPablo Neira Ayuso <pablo@netfilter.org>2016-02-29 13:27:21 +0100
commit017b1b6d28c479f1ad9a7a41f775545a3e1cba35 (patch)
tree595556370e0d68c347acfa0b8560e16623d57de8 /net/netfilter/nfnetlink_acct.c
parent472681d57a5dde7c6d16b05469be57f1c4ed9d99 (diff)
netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters
nfacct_filter_alloc doesn't validate the NFACCT_FILTER_MASK and NFACCT_FILTER_VALUE parameters which can trigger a NULL pointer dereference. CAP_NET_ADMIN is required to trigger the bug. Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nfnetlink_acct.c')
-rw-r--r--net/netfilter/nfnetlink_acct.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 5274b04c42a6..4c2b4c0c4d5f 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -242,6 +242,9 @@ nfacct_filter_alloc(const struct nlattr * const attr)
if (err < 0)
return ERR_PTR(err);
+ if (!tb[NFACCT_FILTER_MASK] || !tb[NFACCT_FILTER_VALUE])
+ return ERR_PTR(-EINVAL);
+
filter = kzalloc(sizeof(struct nfacct_filter), GFP_KERNEL);
if (!filter)
return ERR_PTR(-ENOMEM);