[PATCH nf-next v3 2/2] netfilter: ebtables: ebt_802_3: fix control format test and the ni type offset

[Guo Zihao]

Two long-standing issues in the TYPE match:

 - The control format test is (ctrl & IS_UI), which is also true for an
   S or I format control field (0x01 or 0x02, both two-byte control
   fields), sending the comparison to the wrong view of the union.
   Test for the UI control field exactly, the way LLC_PDU_TYPE_IS_U()
   in include/net/llc_pdu.h does.

 - When the ni view is picked, struct hdr_ni has a padding byte after
   orig[3], so its type field sits at llc offset 8 while the type on
   the wire is at llc offset 7. Every S or I format frame the TYPE
   match compares has therefore been compared against a shifted type
   byte plus a payload byte. Read the type through
   get_unaligned_be16() at the wire offset instead of through the
   struct.

The uAPI struct cannot change because ebtables userspace shares it.

Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---
 net/bridge/netfilter/ebt_802_3.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index fc49f7c7b..0b4b77dc2 100644
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -9,6 +9,7 @@
  *
  */
 #include <linux/module.h>
+#include <linux/unaligned.h>
 #include <linux/stddef.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_bridge/ebtables.h>
@@ -46,8 +47,17 @@ ebt_802_3_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	}
 
 	if (info->bitmask & EBT_802_3_TYPE) {
-		type = frame->llc.ui.ctrl & IS_UI ? frame->llc.ui.type :
-						    frame->llc.ni.type;
+		/* IS_UI is the exact UI control field; the S and I formats
+		 * carry two-byte controls, and their type sits at llc offset
+		 * 7 on the wire while the in-kernel hdr_ni has a padding
+		 * byte before its type field.
+		 */
+		if ((frame->llc.ui.ctrl & IS_UI) == IS_UI) {
+			type = frame->llc.ui.type;
+		} else {
+			type = get_unaligned_be16((__be16 *)((u8 *)frame +
+					offsetof(struct ebt_802_3_hdr, llc) + 7));
+		}
 		if (!(frame->llc.ui.dsap == CHECK_TYPE &&
 		      frame->llc.ui.ssap == CHECK_TYPE))
 			return false;
-- 
2.50.1