Commit c006da0b authored Sep 26, 2016 by Yotam Gigi Committed by David S. Miller Sep 27, 2016

act_ife: Fix false encoding

On ife encode side, the action stores the different tlvs inside the ife
header, where each tlv length field should refer to the length of the
whole tlv (without additional padding) and not just the data length.

On ife decode side, the action iterates over the tlvs in the ife header
and parses them one by one, where in each iteration the current pointer is
advanced according to the tlv size.

Before, the encoding encoded only the data length inside the tlv, which led
to false parsing of ife the header. In addition, due to the fact that the
loop counter was unsigned, it could lead to infinite parsing loop.

This fix changes the loop counter to be signed and fixes the encoding to
take into account the tlv type and size.

Fixes: 28a10c42 ("net sched: fix encoding to use real length")
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Yotam Gigi <yotamg@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 4b1d488a

net/sched/act_ife.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -53,7 +53,7 @@ int ife_tlv_meta_encode(void skbdata, u16 attrtype, u16 dlen, const void dval)
		u32 tlv = (u32 )(skbdata);
		u16 totlen = nla_total_size(dlen); /alignment + hdr /
		char dptr = (char )tlv + NLA_HDRLEN;
		u32 htlv = attrtype << 16 \| dlen;
		u32 htlv = attrtype << 16 \| (dlen + NLA_HDRLEN);

		*tlv = htonl(htlv);
		memset(dptr, 0, totlen - NLA_HDRLEN);
		@@ -627,7 +627,7 @@ static int tcf_ife_decode(struct sk_buff skb, const struct tc_action a,
		struct tcf_ife_info *ife = to_ife(a);
		int action = ife->tcf_action;
		struct ifeheadr ifehdr = (struct ifeheadr )skb->data;
		u16 ifehdrln = ifehdr->metalen;
		int ifehdrln = (int)ifehdr->metalen;
		struct meta_tlvhdr tlv = (struct meta_tlvhdr )(ifehdr->tlv_data);

		spin_lock(&ife->tcf_lock);