Commit 8a61fadb authored by Harald Welte's avatar Harald Welte Committed by David S. Miller

[NETFILTER]: check nf_log function call arguments

Check whether pf is too large in order to prevent array overflow.
Signed-off-by: default avatarHarald Welte <laforge@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d72367b6
...@@ -157,7 +157,7 @@ struct nf_logger { ...@@ -157,7 +157,7 @@ struct nf_logger {
/* Function to register/unregister log function. */ /* Function to register/unregister log function. */
int nf_log_register(int pf, struct nf_logger *logger); int nf_log_register(int pf, struct nf_logger *logger);
void nf_log_unregister_pf(int pf); int nf_log_unregister_pf(int pf);
void nf_log_unregister_logger(struct nf_logger *logger); void nf_log_unregister_logger(struct nf_logger *logger);
/* Calls the registered backend logging function */ /* Calls the registered backend logging function */
......
...@@ -24,6 +24,9 @@ int nf_log_register(int pf, struct nf_logger *logger) ...@@ -24,6 +24,9 @@ int nf_log_register(int pf, struct nf_logger *logger)
{ {
int ret = -EBUSY; int ret = -EBUSY;
if (pf >= NPROTO)
return -EINVAL;
/* Any setup of logging members must be done before /* Any setup of logging members must be done before
* substituting pointer. */ * substituting pointer. */
spin_lock(&nf_log_lock); spin_lock(&nf_log_lock);
...@@ -38,14 +41,19 @@ int nf_log_register(int pf, struct nf_logger *logger) ...@@ -38,14 +41,19 @@ int nf_log_register(int pf, struct nf_logger *logger)
} }
EXPORT_SYMBOL(nf_log_register); EXPORT_SYMBOL(nf_log_register);
void nf_log_unregister_pf(int pf) int nf_log_unregister_pf(int pf)
{ {
if (pf >= NPROTO)
return -EINVAL;
spin_lock(&nf_log_lock); spin_lock(&nf_log_lock);
nf_logging[pf] = NULL; nf_logging[pf] = NULL;
spin_unlock(&nf_log_lock); spin_unlock(&nf_log_lock);
/* Give time to concurrent readers. */ /* Give time to concurrent readers. */
synchronize_net(); synchronize_net();
return 0;
} }
EXPORT_SYMBOL(nf_log_unregister_pf); EXPORT_SYMBOL(nf_log_unregister_pf);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment