compat_do_replace() allocates per-CPU counters from the compat header's
nentries before it parses the entries blob. A malformed request can claim
millions of rules while supplying only a single empty chain, causing a
large vmalloc() before the request is rejected by later validation.
Each rule occupies at least sizeof(struct ebt_entry) bytes in the input
blob. Reject a rule count that cannot fit in entries_size before the
compat path allocates counters.
Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Assisted-by: LLM
Signed-off-by: Zhiling Zou <[email protected]>
---
net/bridge/netfilter/ebtables.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 0bf541936f601..e24b2c0698892 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2269,6 +2269,8 @@ static int compat_copy_ebt_replace_from_user(struct
ebt_replace *repl,
if (tmp.entries_size == 0)
return -EINVAL;
+ if (tmp.nentries > tmp.entries_size / sizeof(struct ebt_entry))
+ return -EINVAL;
if (tmp.nentries >= MAX_EBT_ENTRIES)
return -ENOMEM;
--
2.55.0
