diff options
| author | Amir Vadai <amir@vadai.me> | 2016-11-28 12:56:40 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-03-16 02:27:21 +0000 |
| commit | 1e6f154d4c60f6bcf9b6fb7727c4c016380298e4 (patch) | |
| tree | 32b84762c02959e0b409b7908f7205a45b268e55 /net | |
| parent | 578298cf24c6d451ef6ac91c72c31351d01dc565 (diff) | |
| download | linux-stable-1e6f154d4c60f6bcf9b6fb7727c4c016380298e4.tar.gz linux-stable-1e6f154d4c60f6bcf9b6fb7727c4c016380298e4.tar.bz2 linux-stable-1e6f154d4c60f6bcf9b6fb7727c4c016380298e4.zip | |
net/sched: pedit: make sure that offset is valid
[ Upstream commit 95c2027bfeda21a28eb245121e6a249f38d0788e ]
Add a validation function to make sure offset is valid:
1. Not below skb head (could happen when offset is negative).
2. Validate both 'offset' and 'at'.
Signed-off-by: Amir Vadai <amir@vadai.me>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sched/act_pedit.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c index 27662e19c3bd..8f357a6eb150 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c @@ -103,6 +103,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind) kfree(keys); } +static bool offset_valid(struct sk_buff *skb, int offset) +{ + if (offset > 0 && offset > skb->len) + return false; + + if (offset < 0 && -offset > skb_headroom(skb)) + return false; + + return true; +} + static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, struct tcf_result *res) { @@ -129,6 +140,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, if (tkey->offmask) { char *d, _d; + if (!offset_valid(skb, off + tkey->at)) { + pr_info("tc filter pedit 'at' offset %d out of bounds\n", + off + tkey->at); + goto bad; + } d = skb_header_pointer(skb, off + tkey->at, 1, &_d); if (!d) @@ -141,10 +157,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, " offset must be on 32 bit boundaries\n"); goto bad; } - if (offset > 0 && offset > skb->len) { - pr_info("tc filter pedit" - " offset %d can't exceed pkt length %d\n", - offset, skb->len); + + if (!offset_valid(skb, off + offset)) { + pr_info("tc filter pedit offset %d out of bounds\n", + offset); goto bad; } |