tag 9ee052df7f3383de94aba4c3b4ddefc9714c7f8e
tagger The Android Open Source Project <initial-contribution@android.com> Wed Sep 05 11:32:46 2018 -0700
object 01752d23d7ba8ac608f134fe60311f84b0a0f83e

Android Wear 8.0.0 Release 0.36 (OWDO.180806.001,ray)

commit 01752d23d7ba8ac608f134fe60311f84b0a0f83e
author Florian Westphal <fw@strlen.de> Mon Feb 19 01:24:15 2018 +0100
committer abel_fang <Abel_Fang@compal.com> Mon Jul 23 14:00:05 2018 +0800
tree 3f01fa1d53403aebef9ab62bcb40f5b0718b5b10
parent 73c765876064fdfdc0364298a2a35f4317d32fa0

netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets

We need to make sure the offsets are not out of range of the
total size.
Also check that they are in ascending order.

The WARN_ON triggered by syzkaller (it sets panic_on_warn) is
changed to also bail out, no point in continuing parsing.

Briefly tested with simple ruleset of
-A INPUT --limit 1/s' --log
plus jump to custom chains using 32bit ebtables binary.

Change-Id: Ifd100a520aed16e889183862346cd225a26fbb12
Reported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>