lkml.org 
[lkml]   [2016]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.8 16/45] net/sched: pedit: make sure that offset is valid
    Date
    4.8-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Amir Vadai <amir@vadai.me>


    [ Upstream commit 95c2027bfeda21a28eb245121e6a249f38d0788e ]

    Add a validation function to make sure offset is valid:
    1. Not below skb head (could happen when offset is negative).
    2. Validate both 'offset' and 'at'.

    Signed-off-by: Amir Vadai <amir@vadai.me>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sched/act_pedit.c | 24 ++++++++++++++++++++----
    1 file changed, 20 insertions(+), 4 deletions(-)

    --- a/net/sched/act_pedit.c
    +++ b/net/sched/act_pedit.c
    @@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_
    kfree(keys);
    }

    +static bool offset_valid(struct sk_buff *skb, int offset)
    +{
    + if (offset > 0 && offset > skb->len)
    + return false;
    +
    + if (offset < 0 && -offset > skb_headroom(skb))
    + return false;
    +
    + return true;
    +}
    +
    static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
    struct tcf_result *res)
    {
    @@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb
    if (tkey->offmask) {
    char *d, _d;

    + if (!offset_valid(skb, off + tkey->at)) {
    + pr_info("tc filter pedit 'at' offset %d out of bounds\n",
    + off + tkey->at);
    + goto bad;
    + }
    d = skb_header_pointer(skb, off + tkey->at, 1,
    &_d);
    if (!d)
    @@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb
    " offset must be on 32 bit boundaries\n");
    goto bad;
    }
    - if (offset > 0 && offset > skb->len) {
    - pr_info("tc filter pedit"
    - " offset %d can't exceed pkt length %d\n",
    - offset, skb->len);
    +
    + if (!offset_valid(skb, off + offset)) {
    + pr_info("tc filter pedit offset %d out of bounds\n",
    + offset);
    goto bad;
    }


    \
     
     \ /
      Last update: 2016-12-09 17:30    [W:7.205 / U:1.540 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site