Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PKT_SCHED]: Fix illegal memory dereferences when dumping actions

Browse source 
The TCA_ACT_KIND attribute is used without checking its
availability when dumping actions therefore leading to a
value of 0x4 being dereferenced.

The use of strcmp() in tc_lookup_action_n() isn't safe
when fed with string from an attribute without enforcing
proper NUL termination.

Both bugs can be triggered with malformed netlink message
and don't require any privileges.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Thomas Graf 2006-07-05 20:45:06 -07:00 committed by David S. Miller
parent e340221acd
commit 26dab8930b
1 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
net/sched/act_api.c
View file

@ -776,7 +776,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
return ret; return ret;
} }
static char * static struct rtattr *
find_dump_kind(struct nlmsghdr *n) find_dump_kind(struct nlmsghdr *n)
{ {
struct rtattr *tb1, *tb2[TCA_ACT_MAX+1]; struct rtattr *tb1, *tb2[TCA_ACT_MAX+1];
@ -804,7 +804,7 @@ find_dump_kind(struct nlmsghdr *n)
return NULL; return NULL;
kind = tb2[TCA_ACT_KIND-1]; kind = tb2[TCA_ACT_KIND-1];
return (char *) RTA_DATA(kind); return kind;
} }
static int static int
@ -817,16 +817,15 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
struct tc_action a; struct tc_action a;
int ret = 0; int ret = 0;
struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh); struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
char *kind = find_dump_kind(cb->nlh); struct rtattr *kind = find_dump_kind(cb->nlh);
if (kind == NULL) { if (kind == NULL) {
printk("tc_dump_action: action bad kind\n"); printk("tc_dump_action: action bad kind\n");
return 0; return 0;
} }
a_o = tc_lookup_action_n(kind); a_o = tc_lookup_action(kind);
if (a_o == NULL) { if (a_o == NULL) {
printk("failed to find %s\n", kind);
return 0; return 0;
} }
@ -834,7 +833,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
a.ops = a_o; a.ops = a_o;
if (a_o->walk == NULL) { if (a_o->walk == NULL) {
printk("tc_dump_action: %s !capable of dumping table\n", kind); printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind);
goto rtattr_failure; goto rtattr_failure;
} }