Commit 95c2027b authored by Amir Vadai's avatar Amir Vadai Committed by David S. Miller

net/sched: pedit: make sure that offset is valid

Add a validation function to make sure offset is valid:
1. Not below skb head (could happen when offset is negative).
2. Validate both 'offset' and 'at'.
Signed-off-by: default avatarAmir Vadai <amir@vadai.me>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2dbb4c05
...@@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind) ...@@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind)
kfree(keys); kfree(keys);
} }
static bool offset_valid(struct sk_buff *skb, int offset)
{
if (offset > 0 && offset > skb->len)
return false;
if (offset < 0 && -offset > skb_headroom(skb))
return false;
return true;
}
static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
struct tcf_result *res) struct tcf_result *res)
{ {
...@@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, ...@@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
if (tkey->offmask) { if (tkey->offmask) {
char *d, _d; char *d, _d;
if (!offset_valid(skb, off + tkey->at)) {
pr_info("tc filter pedit 'at' offset %d out of bounds\n",
off + tkey->at);
goto bad;
}
d = skb_header_pointer(skb, off + tkey->at, 1, d = skb_header_pointer(skb, off + tkey->at, 1,
&_d); &_d);
if (!d) if (!d)
...@@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, ...@@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
" offset must be on 32 bit boundaries\n"); " offset must be on 32 bit boundaries\n");
goto bad; goto bad;
} }
if (offset > 0 && offset > skb->len) {
pr_info("tc filter pedit" if (!offset_valid(skb, off + offset)) {
" offset %d can't exceed pkt length %d\n", pr_info("tc filter pedit offset %d out of bounds\n",
offset, skb->len); offset);
goto bad; goto bad;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment