From: Phil Turnbull <phil.turnbull@oracle.com>
Date: Tue, 3 May 2016 20:39:19 +0000 (-0400)
Subject: netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=eda3fc50daa93b08774a18d51883c5a5d8d85e15;p=linux-beck.git

netfilter: nfnetlink_acct: validate NFACCT_QUOTA parameter

If a quota bit is set in NFACCT_FLAGS but the NFACCT_QUOTA parameter is
missing then a NULL pointer dereference is triggered. CAP_NET_ADMIN is
required to trigger the bug.

Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 4c2b4c0c4d5f..dbd0803b1827 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -96,6 +96,8 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
 			return -EINVAL;
 		if (flags & NFACCT_F_OVERQUOTA)
 			return -EINVAL;
+		if ((flags & NFACCT_F_QUOTA) && !tb[NFACCT_QUOTA])
+			return -EINVAL;
 
 		size += sizeof(u64);
 	}