Message ID | 20191207193445.135760-1-edumazet@google.com |
---|---|
State | Accepted |
Delegated to: | David Miller |
Headers | show |
Series | [net,v2] net_sched: validate TCA_KIND attribute in tc_chain_tmplt_add() | expand |
From: Eric Dumazet <edumazet@google.com> Date: Sat, 7 Dec 2019 11:34:45 -0800 > Use the new tcf_proto_check_kind() helper to make sure user > provided value is well formed. ... > Fixes: 6f96c3c6904c ("net_sched: fix backward compatibility for TCA_KIND") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: syzbot <syzkaller@googlegroups.com> > Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Applied and queued up for -stable. Oh how I love such long chains of stable backport requirements... ("gdc" is "git describe --contains") [davem@localhost net]$ gdc 6f96c3c6904c v5.4-rc4~6^2~79 [davem@localhost net]$ git show 6f96c3c6904c | grep Fixes Fixes: 62794fc4fbf5 ("net_sched: add max len check for TCA_KIND") [davem@localhost net]$ gdc 62794fc4fbf5 v5.4-rc1~14^2~68 [davem@localhost net]$ git show 62794fc4fbf5 | grep Fixes Fixes: 8b4c3cdd9dd8 ("net: sched: Add policy validation for tc attributes") [davem@localhost net]$ gdc 8b4c3cdd9dd8 v4.19-rc7~7^2~2 [davem@localhost net]$ git show 8b4c3cdd9dd8 | grep Fixes The 2 Fixes tags below cover the latest additions. The other attributes Fixes: 5bc1701881e39 ("net: sched: introduce multichain support for filters") Fixes: d47a6b0e7c492 ("net: sched: introduce ingress/egress block index attributes for qdisc") [davem@localhost net]$ gdc 5bc1701881e39 v4.13-rc1~157^2~434^2~2 [davem@localhost net]$ gdc d47a6b0e7c492 v4.16-rc1~123^2~139^2~5 I mean seriously, that is such a lovely chain of fixups for fixups... :-)
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 3c335fd9bcb0d1a3303372b975726c221c136dca..6a0eacafdb19117701e70fbec63ca7028ecd14a9 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -2735,13 +2735,19 @@ static int tc_chain_tmplt_add(struct tcf_chain *chain, struct net *net, struct netlink_ext_ack *extack) { const struct tcf_proto_ops *ops; + char name[IFNAMSIZ]; void *tmplt_priv; /* If kind is not set, user did not specify template. */ if (!tca[TCA_KIND]) return 0; - ops = tcf_proto_lookup_ops(nla_data(tca[TCA_KIND]), true, extack); + if (tcf_proto_check_kind(tca[TCA_KIND], name)) { + NL_SET_ERR_MSG(extack, "Specified TC chain template name too long"); + return -EINVAL; + } + + ops = tcf_proto_lookup_ops(name, true, extack); if (IS_ERR(ops)) return PTR_ERR(ops); if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump) {