From: Changli Gao <xiaosuo@gmail.com>
To: Patrick McHardy <kaber@trash.net>
Cc: Jamal Hadi Salim <hadi@cyberus.ca>,
"David S. Miller" <davem@davemloft.net>,
netdev@vger.kernel.org, Changli Gao <xiaosuo@gmail.com>
Subject: [PATCH v2 2/4] cls_flow: add sanity check for the packet length
Date: Wed, 4 Aug 2010 22:48:12 +0800 [thread overview]
Message-ID: <1280933292-12176-1-git-send-email-xiaosuo@gmail.com> (raw)
The packet length should be checked before the packet data is dereferenced.
Signed-off-by: Changli Gao <xiaosuo@gmail.com>
---
v2: use pskb_network_may_pull(), and handle the error path gracefully.
remove the return value change.
net/sched/cls_flow.c | 96 +++++++++++++++++++++++++++++----------------------
1 file changed, 56 insertions(+), 40 deletions(-)
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index f73542d..e17096e 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -65,37 +65,47 @@ static inline u32 addr_fold(void *addr)
return (a & 0xFFFFFFFF) ^ (BITS_PER_LONG > 32 ? a >> 32 : 0);
}
-static u32 flow_get_src(const struct sk_buff *skb)
+static u32 flow_get_src(struct sk_buff *skb)
{
switch (skb->protocol) {
case htons(ETH_P_IP):
- return ntohl(ip_hdr(skb)->saddr);
+ if (pskb_network_may_pull(skb, sizeof(struct iphdr)))
+ return ntohl(ip_hdr(skb)->saddr);
+ break;
case htons(ETH_P_IPV6):
- return ntohl(ipv6_hdr(skb)->saddr.s6_addr32[3]);
- default:
- return addr_fold(skb->sk);
+ if (pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
+ return ntohl(ipv6_hdr(skb)->saddr.s6_addr32[3]);
+ break;
}
+
+ return addr_fold(skb->sk);
}
-static u32 flow_get_dst(const struct sk_buff *skb)
+static u32 flow_get_dst(struct sk_buff *skb)
{
switch (skb->protocol) {
case htons(ETH_P_IP):
- return ntohl(ip_hdr(skb)->daddr);
+ if (pskb_network_may_pull(skb, sizeof(struct iphdr)))
+ return ntohl(ip_hdr(skb)->daddr);
+ break;
case htons(ETH_P_IPV6):
- return ntohl(ipv6_hdr(skb)->daddr.s6_addr32[3]);
- default:
- return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
+ if (pskb_network_may_pull(skb, sizeof(struct ipv6hdr)))
+ return ntohl(ipv6_hdr(skb)->daddr.s6_addr32[3]);
+ break;
}
+
+ return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
}
-static u32 flow_get_proto(const struct sk_buff *skb)
+static u32 flow_get_proto(struct sk_buff *skb)
{
switch (skb->protocol) {
case htons(ETH_P_IP):
- return ip_hdr(skb)->protocol;
+ return pskb_network_may_pull(skb, sizeof(struct iphdr)) ?
+ ip_hdr(skb)->protocol : 0;
case htons(ETH_P_IPV6):
- return ipv6_hdr(skb)->nexthdr;
+ return pskb_network_may_pull(skb, sizeof(struct ipv6hdr)) ?
+ ipv6_hdr(skb)->nexthdr : 0;
default:
return 0;
}
@@ -116,58 +126,64 @@ static int has_ports(u8 protocol)
}
}
-static u32 flow_get_proto_src(const struct sk_buff *skb)
+static u32 flow_get_proto_src(struct sk_buff *skb)
{
- u32 res = 0;
-
switch (skb->protocol) {
case htons(ETH_P_IP): {
- struct iphdr *iph = ip_hdr(skb);
+ struct iphdr *iph;
+ if (!pskb_network_may_pull(skb, sizeof(*iph)))
+ break;
+ iph = ip_hdr(skb);
if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
- has_ports(iph->protocol))
- res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4));
+ has_ports(iph->protocol) &&
+ pskb_network_may_pull(skb, iph->ihl * 4 + 2))
+ return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4));
break;
}
case htons(ETH_P_IPV6): {
- struct ipv6hdr *iph = ipv6_hdr(skb);
+ struct ipv6hdr *iph;
+ if (!pskb_network_may_pull(skb, sizeof(*iph) + 2))
+ break;
+ iph = ipv6_hdr(skb);
if (has_ports(iph->nexthdr))
- res = ntohs(*(__be16 *)&iph[1]);
+ return ntohs(*(__be16 *)&iph[1]);
break;
}
- default:
- res = addr_fold(skb->sk);
}
- return res;
+ return addr_fold(skb->sk);
}
-static u32 flow_get_proto_dst(const struct sk_buff *skb)
+static u32 flow_get_proto_dst(struct sk_buff *skb)
{
- u32 res = 0;
-
switch (skb->protocol) {
case htons(ETH_P_IP): {
- struct iphdr *iph = ip_hdr(skb);
+ struct iphdr *iph;
+ if (!pskb_network_may_pull(skb, sizeof(*iph)))
+ break;
+ iph = ip_hdr(skb);
if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
- has_ports(iph->protocol))
- res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2));
+ has_ports(iph->protocol) &&
+ pskb_network_may_pull(skb, iph->ihl * 4 + 4))
+ return ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2));
break;
}
case htons(ETH_P_IPV6): {
- struct ipv6hdr *iph = ipv6_hdr(skb);
+ struct ipv6hdr *iph;
+ if (!pskb_network_may_pull(skb, sizeof(*iph) + 4))
+ break;
+ iph = ipv6_hdr(skb);
if (has_ports(iph->nexthdr))
- res = ntohs(*(__be16 *)((void *)&iph[1] + 2));
+ return ntohs(*(__be16 *)((void *)&iph[1] + 2));
break;
}
- default:
- res = addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
}
- return res;
+ return addr_fold(skb_dst(skb)) ^ (__force u16)skb->protocol;
}
static u32 flow_get_iif(const struct sk_buff *skb)
@@ -211,7 +227,7 @@ static u32 flow_get_nfct(const struct sk_buff *skb)
})
#endif
-static u32 flow_get_nfct_src(const struct sk_buff *skb)
+static u32 flow_get_nfct_src(struct sk_buff *skb)
{
switch (skb->protocol) {
case htons(ETH_P_IP):
@@ -223,7 +239,7 @@ fallback:
return flow_get_src(skb);
}
-static u32 flow_get_nfct_dst(const struct sk_buff *skb)
+static u32 flow_get_nfct_dst(struct sk_buff *skb)
{
switch (skb->protocol) {
case htons(ETH_P_IP):
@@ -235,14 +251,14 @@ fallback:
return flow_get_dst(skb);
}
-static u32 flow_get_nfct_proto_src(const struct sk_buff *skb)
+static u32 flow_get_nfct_proto_src(struct sk_buff *skb)
{
return ntohs(CTTUPLE(skb, src.u.all));
fallback:
return flow_get_proto_src(skb);
}
-static u32 flow_get_nfct_proto_dst(const struct sk_buff *skb)
+static u32 flow_get_nfct_proto_dst(struct sk_buff *skb)
{
return ntohs(CTTUPLE(skb, dst.u.all));
fallback:
@@ -281,7 +297,7 @@ static u32 flow_get_vlan_tag(const struct sk_buff *skb)
return tag & VLAN_VID_MASK;
}
-static u32 flow_key_get(const struct sk_buff *skb, int key)
+static u32 flow_key_get(struct sk_buff *skb, int key)
{
switch (key) {
case FLOW_KEY_SRC:
next reply other threads:[~2010-08-04 14:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-08-04 14:48 Changli Gao [this message]
2010-08-04 16:12 ` [PATCH v2 2/4] cls_flow: add sanity check for the packet length Patrick McHardy
2010-08-05 4:55 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1280933292-12176-1-git-send-email-xiaosuo@gmail.com \
--to=xiaosuo@gmail.com \
--cc=davem@davemloft.net \
--cc=hadi@cyberus.ca \
--cc=kaber@trash.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.