[PATCH] net: sched: em_ipt: validate hook value from netlink

[Fang Xieyan]

em_ipt_change() accepts the user-provided TCA_EM_IPT_HOOK value
without validating its range.

The value is later used in check_match() as "1 << im->hook".  A hook
value of 32 or greater causes undefined behavior and may undermine the
xt match hook-mask validation.  The value is also passed to
nf_hook_state_init() as a hook index.

Reject hook values outside the supported IPv4/IPv6 Netfilter hook
range after checking the required attributes, before loading the xt
match or allocating the match state.

Reviewed-by: Weibin Liu <liuwb@xxxxxxxxxxxx>
Signed-off-by: Fang Xieyan <fangxy@xxxxxxxxxxxx>
---
 net/sched/em_ipt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sched/em_ipt.c b/net/sched/em_ipt.c
index 3650117da..e4a8c1f0a 100644
--- a/net/sched/em_ipt.c
+++ b/net/sched/em_ipt.c
@@ -142,6 +142,9 @@ static int em_ipt_change(struct net *net, void *data, int data_len,
 	    !tb[TCA_EM_IPT_MATCH_DATA] || !tb[TCA_EM_IPT_NFPROTO])
 		return -EINVAL;
 
+	if (nla_get_u32(tb[TCA_EM_IPT_HOOK]) >= NF_INET_NUMHOOKS)
+		return -EINVAL;
+
 	nfproto = nla_get_u8(tb[TCA_EM_IPT_NFPROTO]);
 	switch (nfproto) {
 	case NFPROTO_IPV4:
-- 
2.50.1