net: sched: Add policy validation for tc attributes
[ Upstream commitpull/10/head8b4c3cdd9d
] A number of TC attributes are processed without proper validation (e.g., length checks). Add a tca policy for all input attributes and use when invoking nlmsg_parse. The 2 Fixes tags below cover the latest additions. The other attributes are a string (KIND), nested attribute (OPTIONS which does seem to have validation in most cases), for dumps only or a flag. Fixes:5bc1701881
("net: sched: introduce multichain support for filters") Fixes:d47a6b0e7c
("net: sched: introduce ingress/egress block index attributes for qdisc") Signed-off-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
85ebbc5a25
commit
d905742331
|
@ -1216,6 +1216,16 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
|
||||||
* Delete/get qdisc.
|
* Delete/get qdisc.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
|
||||||
|
[TCA_KIND] = { .type = NLA_STRING },
|
||||||
|
[TCA_OPTIONS] = { .type = NLA_NESTED },
|
||||||
|
[TCA_RATE] = { .type = NLA_BINARY,
|
||||||
|
.len = sizeof(struct tc_estimator) },
|
||||||
|
[TCA_STAB] = { .type = NLA_NESTED },
|
||||||
|
[TCA_DUMP_INVISIBLE] = { .type = NLA_FLAG },
|
||||||
|
[TCA_CHAIN] = { .type = NLA_U32 },
|
||||||
|
};
|
||||||
|
|
||||||
static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
|
static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
|
||||||
struct netlink_ext_ack *extack)
|
struct netlink_ext_ack *extack)
|
||||||
{
|
{
|
||||||
|
@ -1232,7 +1242,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
|
||||||
!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
|
!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
|
||||||
return -EPERM;
|
return -EPERM;
|
||||||
|
|
||||||
err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
|
err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
|
||||||
|
extack);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
@ -1302,7 +1313,8 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
|
||||||
|
|
||||||
replay:
|
replay:
|
||||||
/* Reinit, just in case something touches this. */
|
/* Reinit, just in case something touches this. */
|
||||||
err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
|
err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
|
||||||
|
extack);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
@ -1512,7 +1524,8 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
|
||||||
idx = 0;
|
idx = 0;
|
||||||
ASSERT_RTNL();
|
ASSERT_RTNL();
|
||||||
|
|
||||||
err = nlmsg_parse(nlh, sizeof(*tcm), tca, TCA_MAX, NULL, NULL);
|
err = nlmsg_parse(nlh, sizeof(*tcm), tca, TCA_MAX,
|
||||||
|
rtm_tca_policy, NULL);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
@ -1729,7 +1742,8 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,
|
||||||
!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
|
!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
|
||||||
return -EPERM;
|
return -EPERM;
|
||||||
|
|
||||||
err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
|
err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
|
||||||
|
extack);
|
||||||
if (err < 0)
|
if (err < 0)
|
||||||
return err;
|
return err;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue