diff options
| author | Thomas Graf <tgraf@suug.ch> | 2006-07-05 20:58:02 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-07-24 20:35:21 -0700 |
| commit | 5bf5d453cd5479783020d2cd76138812de947106 (patch) | |
| tree | aac75c546c838ad1e60e2b4e1dff690f5b083759 | |
| parent | d7f69eaa106a0b46474e116216a81f72ff28e507 (diff) | |
| download | linux-stable-5bf5d453cd5479783020d2cd76138812de947106.tar.gz linux-stable-5bf5d453cd5479783020d2cd76138812de947106.tar.bz2 linux-stable-5bf5d453cd5479783020d2cd76138812de947106.zip | |
PKT_SCHED: Fix illegal memory dereferences when dumping actions
The TCA_ACT_KIND attribute is used without checking its
availability when dumping actions therefore leading to a
value of 0x4 being dereferenced.
The use of strcmp() in tc_lookup_action_n() isn't safe
when fed with string from an attribute without enforcing
proper NUL termination.
Both bugs can be triggered with malformed netlink message
and don't require any privileges.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | net/sched/act_api.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 2ffa11c6e8de..2c2c37191ffd 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -777,7 +777,7 @@ replay: return ret; } -static char * +static struct rtattr * find_dump_kind(struct nlmsghdr *n) { struct rtattr *tb1, *tb2[TCA_ACT_MAX+1]; @@ -805,7 +805,7 @@ find_dump_kind(struct nlmsghdr *n) return NULL; kind = tb2[TCA_ACT_KIND-1]; - return (char *) RTA_DATA(kind); + return kind; } static int @@ -818,16 +818,15 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb) struct tc_action a; int ret = 0; struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh); - char *kind = find_dump_kind(cb->nlh); + struct rtattr *kind = find_dump_kind(cb->nlh); if (kind == NULL) { printk("tc_dump_action: action bad kind\n"); return 0; } - a_o = tc_lookup_action_n(kind); + a_o = tc_lookup_action(kind); if (a_o == NULL) { - printk("failed to find %s\n", kind); return 0; } @@ -835,7 +834,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb) a.ops = a_o; if (a_o->walk == NULL) { - printk("tc_dump_action: %s !capable of dumping table\n", kind); + printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind); goto rtattr_failure; } |