diff options
author | Thomas Graf <tgraf@suug.ch> | 2006-07-05 23:45:06 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2006-07-05 23:45:06 -0400 |
commit | 26dab8930b408d5e5eb9ef496d68364dc955e249 (patch) | |
tree | 3ddcc939b167a66638b91fa423882048faf6b8ca | |
parent | e340221acda6bc0bf05a0ff6e6114902c4307670 (diff) |
[PKT_SCHED]: Fix illegal memory dereferences when dumping actions
The TCA_ACT_KIND attribute is used without checking its
availability when dumping actions therefore leading to a
value of 0x4 being dereferenced.
The use of strcmp() in tc_lookup_action_n() isn't safe
when fed with string from an attribute without enforcing
proper NUL termination.
Both bugs can be triggered with malformed netlink message
and don't require any privileges.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/sched/act_api.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/net/sched/act_api.c b/net/sched/act_api.c index 5b9397b33238..f9d1d78e17f8 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c | |||
@@ -776,7 +776,7 @@ replay: | |||
776 | return ret; | 776 | return ret; |
777 | } | 777 | } |
778 | 778 | ||
779 | static char * | 779 | static struct rtattr * |
780 | find_dump_kind(struct nlmsghdr *n) | 780 | find_dump_kind(struct nlmsghdr *n) |
781 | { | 781 | { |
782 | struct rtattr *tb1, *tb2[TCA_ACT_MAX+1]; | 782 | struct rtattr *tb1, *tb2[TCA_ACT_MAX+1]; |
@@ -804,7 +804,7 @@ find_dump_kind(struct nlmsghdr *n) | |||
804 | return NULL; | 804 | return NULL; |
805 | kind = tb2[TCA_ACT_KIND-1]; | 805 | kind = tb2[TCA_ACT_KIND-1]; |
806 | 806 | ||
807 | return (char *) RTA_DATA(kind); | 807 | return kind; |
808 | } | 808 | } |
809 | 809 | ||
810 | static int | 810 | static int |
@@ -817,16 +817,15 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb) | |||
817 | struct tc_action a; | 817 | struct tc_action a; |
818 | int ret = 0; | 818 | int ret = 0; |
819 | struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh); | 819 | struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh); |
820 | char *kind = find_dump_kind(cb->nlh); | 820 | struct rtattr *kind = find_dump_kind(cb->nlh); |
821 | 821 | ||
822 | if (kind == NULL) { | 822 | if (kind == NULL) { |
823 | printk("tc_dump_action: action bad kind\n"); | 823 | printk("tc_dump_action: action bad kind\n"); |
824 | return 0; | 824 | return 0; |
825 | } | 825 | } |
826 | 826 | ||
827 | a_o = tc_lookup_action_n(kind); | 827 | a_o = tc_lookup_action(kind); |
828 | if (a_o == NULL) { | 828 | if (a_o == NULL) { |
829 | printk("failed to find %s\n", kind); | ||
830 | return 0; | 829 | return 0; |
831 | } | 830 | } |
832 | 831 | ||
@@ -834,7 +833,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb) | |||
834 | a.ops = a_o; | 833 | a.ops = a_o; |
835 | 834 | ||
836 | if (a_o->walk == NULL) { | 835 | if (a_o->walk == NULL) { |
837 | printk("tc_dump_action: %s !capable of dumping table\n", kind); | 836 | printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind); |
838 | goto rtattr_failure; | 837 | goto rtattr_failure; |
839 | } | 838 | } |
840 | 839 | ||