lkml.org 
[lkml]   [2018]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 015/135] net: sched: Add policy validation for tc attributes
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: David Ahern <dsahern@gmail.com>

    [ Upstream commit 8b4c3cdd9dd8290343ce959a132d3b334062c5b9 ]

    A number of TC attributes are processed without proper validation
    (e.g., length checks). Add a tca policy for all input attributes and use
    when invoking nlmsg_parse.

    The 2 Fixes tags below cover the latest additions. The other attributes
    are a string (KIND), nested attribute (OPTIONS which does seem to have
    validation in most cases), for dumps only or a flag.

    Fixes: 5bc1701881e39 ("net: sched: introduce multichain support for filters")
    Fixes: d47a6b0e7c492 ("net: sched: introduce ingress/egress block index attributes for qdisc")
    Signed-off-by: David Ahern <dsahern@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sched/sch_api.c | 24 ++++++++++++++++++++----
    1 file changed, 20 insertions(+), 4 deletions(-)

    --- a/net/sched/sch_api.c
    +++ b/net/sched/sch_api.c
    @@ -1304,6 +1304,18 @@ check_loop_fn(struct Qdisc *q, unsigned
    * Delete/get qdisc.
    */

    +const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
    + [TCA_KIND] = { .type = NLA_STRING },
    + [TCA_OPTIONS] = { .type = NLA_NESTED },
    + [TCA_RATE] = { .type = NLA_BINARY,
    + .len = sizeof(struct tc_estimator) },
    + [TCA_STAB] = { .type = NLA_NESTED },
    + [TCA_DUMP_INVISIBLE] = { .type = NLA_FLAG },
    + [TCA_CHAIN] = { .type = NLA_U32 },
    + [TCA_INGRESS_BLOCK] = { .type = NLA_U32 },
    + [TCA_EGRESS_BLOCK] = { .type = NLA_U32 },
    +};
    +
    static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
    struct netlink_ext_ack *extack)
    {
    @@ -1320,7 +1332,8 @@ static int tc_get_qdisc(struct sk_buff *
    !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
    return -EPERM;

    - err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
    + err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
    + extack);
    if (err < 0)
    return err;

    @@ -1404,7 +1417,8 @@ static int tc_modify_qdisc(struct sk_buf

    replay:
    /* Reinit, just in case something touches this. */
    - err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
    + err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
    + extack);
    if (err < 0)
    return err;

    @@ -1638,7 +1652,8 @@ static int tc_dump_qdisc(struct sk_buff
    idx = 0;
    ASSERT_RTNL();

    - err = nlmsg_parse(nlh, sizeof(struct tcmsg), tca, TCA_MAX, NULL, NULL);
    + err = nlmsg_parse(nlh, sizeof(struct tcmsg), tca, TCA_MAX,
    + rtm_tca_policy, NULL);
    if (err < 0)
    return err;

    @@ -1857,7 +1872,8 @@ static int tc_ctl_tclass(struct sk_buff
    !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
    return -EPERM;

    - err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
    + err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
    + extack);
    if (err < 0)
    return err;


    \
     
     \ /
      Last update: 2018-10-16 19:47    [W:5.596 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site