Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95c2027b authored by Amir Vadai's avatar Amir Vadai Committed by David S. Miller
Browse files

net/sched: pedit: make sure that offset is valid 



Add a validation function to make sure offset is valid:
1. Not below skb head (could happen when offset is negative).
2. Validate both 'offset' and 'at'.

Signed-off-by: default avatarAmir Vadai <amir@vadai.me>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2dbb4c05

net/sched/act_pedit.c

+20 −4
Original line number Original line Diff line number Diff line
@@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind) 
	kfree(keys);

	kfree(keys);

}

}





static bool offset_valid(struct sk_buff *skb, int offset)

{

	if (offset > 0 && offset > skb->len)

		return false;



	if  (offset < 0 && -offset > skb_headroom(skb))

		return false;



	return true;

}



static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,

static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,

		     struct tcf_result *res)

		     struct tcf_result *res)

{

{
@@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, 
			if (tkey->offmask) {

			if (tkey->offmask) {

				char *d, _d;

				char *d, _d;





				if (!offset_valid(skb, off + tkey->at)) {

					pr_info("tc filter pedit 'at' offset %d out of bounds\n",

						off + tkey->at);

					goto bad;

				}

				d = skb_header_pointer(skb, off + tkey->at, 1,

				d = skb_header_pointer(skb, off + tkey->at, 1,

						       &_d);

						       &_d);

				if (!d)

				if (!d)
@@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, 
					" offset must be on 32 bit boundaries\n");

					" offset must be on 32 bit boundaries\n");

				goto bad;

				goto bad;

			}

			}

			if (offset > 0 && offset > skb->len) {



				pr_info("tc filter pedit"

			if (!offset_valid(skb, off + offset)) {

					" offset %d can't exceed pkt length %d\n",

				pr_info("tc filter pedit offset %d out of bounds\n",

				       offset, skb->len);

					offset);

				goto bad;

				goto bad;

			}

			}