| commit | a18aa31b7774d8b36048e256a02d9d689533fc96 | |
| author | Patrick McHardy <kaber@trash.net> | |
| Wed, 12 Dec 2007 18:35:16 +0000 (12 10:35 -0800) | ||
| committer | David S. Miller <davem@sunset.davemloft.net> | |
| Fri, 14 Dec 2007 21:54:35 +0000 (14 13:54 -0800) | ||
| tree | 095e8f12e838b819961adea85738c0a6e72048a9 | treesnapshot (tar.gz zip) |
| parent | f2a89004da23a5ed2d78ac5550ccda5b714fe7d0 | commitdiff |
[NETFILTER]: ip_tables: fix compat copy race
When copying entries to user, the kernel makes two passes through the
data, first copying all the entries, then fixing up names and counters.
On the second pass it copies the kernel and match data from userspace
to the kernel again to find the corresponding structures, expecting
that kernel pointers contained in the data are still valid.
This is obviously broken, fix by avoiding the second pass completely
and fixing names and counters while dumping the ruleset, using the
kernel-internal data structures.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
When copying entries to user, the kernel makes two passes through the
data, first copying all the entries, then fixing up names and counters.
On the second pass it copies the kernel and match data from userspace
to the kernel again to find the corresponding structures, expecting
that kernel pointers contained in the data are still valid.
This is obviously broken, fix by avoiding the second pass completely
and fixing names and counters while dumping the ruleset, using the
kernel-internal data structures.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
| net/ipv4/netfilter/ip_tables.c | diffblobblamehistory | |
| net/netfilter/x_tables.c | diffblobblamehistory |