Merge tag 'v3.10.103' into update

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / ipv6 / netfilter / ip6_tables.c

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e214222cd06f7900a416a18a8b0c22209a23aa79..beebca7c139b4ddf185858a4ea6741e7155bb494 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -203,6 +203,7 @@ static inline bool unconditional(const struct ip6t_entry *e)
               memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
 }
 
+
 static inline const struct xt_entry_target *
 ip6t_get_target_c(const struct ip6t_entry *e)
 {
@@ -572,6 +573,25 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
        module_put(par.match->me);
 }
 
+static int
+check_entry(const struct ip6t_entry *e)
+{
+       const struct xt_entry_target *t;
+
+       if (!ip6_checkentry(&e->ipv6))
+               return -EINVAL;
+
+       if (e->target_offset + sizeof(struct xt_entry_target) >
+           e->next_offset)
+               return -EINVAL;
+
+       t = ip6t_get_target_c(e);
+       if (e->target_offset + t->u.target_size > e->next_offset)
+               return -EINVAL;
+
+       return 0;
+}
+
 static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 {
        const struct ip6t_ip6 *ipv6 = par->entryinfo;
@@ -729,11 +749,8 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
                return -EINVAL;
        }
 
-       if (!ip6_checkentry(&e->ipv6))
-               return -EINVAL;
+       err = check_entry(e);
 
-       err = xt_check_entry_offsets(e, e->elems, e->target_offset,
-                                    e->next_offset);
        if (err)
                return err;
 
@@ -1458,11 +1475,9 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
                return -EINVAL;
        }
 
-       if (!ip6_checkentry(&e->ipv6))
-               return -EINVAL;
+       /* For purposes of check_entry casting the compat entry is fine */
+       ret = check_entry((struct ip6t_entry *)e);
 
-       ret = xt_compat_check_entry_offsets(e, e->elems,
-                                           e->target_offset, e->next_offset);
        if (ret)
                return ret;