aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorThomas Graf <tgraf@suug.ch>2006-07-05 23:45:06 -0400
committerDavid S. Miller <davem@davemloft.net>2006-07-05 23:45:06 -0400
commit26dab8930b408d5e5eb9ef496d68364dc955e249 (patch)
tree3ddcc939b167a66638b91fa423882048faf6b8ca
parente340221acda6bc0bf05a0ff6e6114902c4307670 (diff)
[PKT_SCHED]: Fix illegal memory dereferences when dumping actions
The TCA_ACT_KIND attribute is used without checking its availability when dumping actions therefore leading to a value of 0x4 being dereferenced. The use of strcmp() in tc_lookup_action_n() isn't safe when fed with string from an attribute without enforcing proper NUL termination. Both bugs can be triggered with malformed netlink message and don't require any privileges. Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/sched/act_api.c11
1 files changed, 5 insertions, 6 deletions
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 5b9397b33238..f9d1d78e17f8 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -776,7 +776,7 @@ replay:
776 return ret; 776 return ret;
777} 777}
778 778
779static char * 779static struct rtattr *
780find_dump_kind(struct nlmsghdr *n) 780find_dump_kind(struct nlmsghdr *n)
781{ 781{
782 struct rtattr *tb1, *tb2[TCA_ACT_MAX+1]; 782 struct rtattr *tb1, *tb2[TCA_ACT_MAX+1];
@@ -804,7 +804,7 @@ find_dump_kind(struct nlmsghdr *n)
804 return NULL; 804 return NULL;
805 kind = tb2[TCA_ACT_KIND-1]; 805 kind = tb2[TCA_ACT_KIND-1];
806 806
807 return (char *) RTA_DATA(kind); 807 return kind;
808} 808}
809 809
810static int 810static int
@@ -817,16 +817,15 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
817 struct tc_action a; 817 struct tc_action a;
818 int ret = 0; 818 int ret = 0;
819 struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh); 819 struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
820 char *kind = find_dump_kind(cb->nlh); 820 struct rtattr *kind = find_dump_kind(cb->nlh);
821 821
822 if (kind == NULL) { 822 if (kind == NULL) {
823 printk("tc_dump_action: action bad kind\n"); 823 printk("tc_dump_action: action bad kind\n");
824 return 0; 824 return 0;
825 } 825 }
826 826
827 a_o = tc_lookup_action_n(kind); 827 a_o = tc_lookup_action(kind);
828 if (a_o == NULL) { 828 if (a_o == NULL) {
829 printk("failed to find %s\n", kind);
830 return 0; 829 return 0;
831 } 830 }
832 831
@@ -834,7 +833,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
834 a.ops = a_o; 833 a.ops = a_o;
835 834
836 if (a_o->walk == NULL) { 835 if (a_o->walk == NULL) {
837 printk("tc_dump_action: %s !capable of dumping table\n", kind); 836 printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind);
838 goto rtattr_failure; 837 goto rtattr_failure;
839 } 838 }
840 839