mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-03 07:38:10 +00:00
Code Issues Releases Wiki Activity

net/sched: flower: Fix null pointer dereference when run tc vlan command

Browse source 
Zahari issued tc vlan command without setting vlan_ethtype, which will
crash kernel. To avoid this, we must check tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]
is not null before use it.
Also we don't need to dump vlan_ethtype or cvlan_ethtype in this case.

Fixes: d64efd0926 ('net/sched: flower: Add supprt for matching on QinQ vlan headers')
Signed-off-by: Jianbo Liu <jianbol@mellanox.com>
Reported-by: Zahari Doychev <zahari.doychev@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jianbo Liu 2018-07-09 02:26:20 +00:00 committed by David S. Miller
parent db560d1612
commit 5e9a0fe492
1 changed files with 26 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
net/sched/cls_flower.c
View file

@ -605,20 +605,22 @@ static int fl_set_key(struct net *net, struct nlattr **tb,
TCA_FLOWER_KEY_VLAN_PRIO, &key->vlan, TCA_FLOWER_KEY_VLAN_PRIO, &key->vlan,
&mask->vlan); &mask->vlan);
ethertype = nla_get_be16(tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]); if (tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]) {
if (eth_type_vlan(ethertype)) { ethertype = nla_get_be16(tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]);
fl_set_key_vlan(tb, ethertype, if (eth_type_vlan(ethertype)) {
TCA_FLOWER_KEY_CVLAN_ID, fl_set_key_vlan(tb, ethertype,
TCA_FLOWER_KEY_CVLAN_PRIO, TCA_FLOWER_KEY_CVLAN_ID,
&key->cvlan, &mask->cvlan); TCA_FLOWER_KEY_CVLAN_PRIO,
fl_set_key_val(tb, &key->basic.n_proto, &key->cvlan, &mask->cvlan);
TCA_FLOWER_KEY_CVLAN_ETH_TYPE, fl_set_key_val(tb, &key->basic.n_proto,
&mask->basic.n_proto, TCA_FLOWER_KEY_CVLAN_ETH_TYPE,
TCA_FLOWER_UNSPEC, &mask->basic.n_proto,
sizeof(key->basic.n_proto)); TCA_FLOWER_UNSPEC,
} else { sizeof(key->basic.n_proto));
key->basic.n_proto = ethertype; } else {
mask->basic.n_proto = cpu_to_be16(~0); key->basic.n_proto = ethertype;
mask->basic.n_proto = cpu_to_be16(~0);
}
} }
} else { } else {
key->basic.n_proto = ethertype; key->basic.n_proto = ethertype;
@ -1344,14 +1346,16 @@ static int fl_dump(struct net *net, struct tcf_proto *tp, void *fh,
key->cvlan.vlan_tpid))) key->cvlan.vlan_tpid)))
goto nla_put_failure; goto nla_put_failure;
if (mask->cvlan.vlan_tpid) { if (mask->basic.n_proto) {
if (nla_put_be16(skb, TCA_FLOWER_KEY_CVLAN_ETH_TYPE, if (mask->cvlan.vlan_tpid) {
key->basic.n_proto)) if (nla_put_be16(skb, TCA_FLOWER_KEY_CVLAN_ETH_TYPE,
goto nla_put_failure; key->basic.n_proto))
} else if (mask->vlan.vlan_tpid) { goto nla_put_failure;
if (nla_put_be16(skb, TCA_FLOWER_KEY_VLAN_ETH_TYPE, } else if (mask->vlan.vlan_tpid) {
key->basic.n_proto)) if (nla_put_be16(skb, TCA_FLOWER_KEY_VLAN_ETH_TYPE,
goto nla_put_failure; key->basic.n_proto))
goto nla_put_failure;
}
} }
if ((key->basic.n_proto == htons(ETH_P_IP) || if ((key->basic.n_proto == htons(ETH_P_IP) ||