From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, bunk@stusta.de,
Thomas Graf <tgraf@suug.ch>, Patrick McHardy <kaber@trash.net>,
"David S. Miller" <davem@davemloft.net>
Subject: [patch 19/37] NET: Fix FIB rules compatability
Date: Fri, 30 Mar 2007 14:05:06 -0700 [thread overview]
Message-ID: <20070330210506.GV29450@kroah.com> (raw)
In-Reply-To: <20070330210334.GA29450@kroah.com>
[-- Attachment #1: net-fix-fib-rules-compatability.patch --]
[-- Type: text/plain, Size: 7820 bytes --]
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thomas Graf <tgraf@suug.ch>
[NET]: Fix fib_rules compatibility breakage
Based upon a patch from Patrick McHardy.
The fib_rules netlink attribute policy introduced in 2.6.19 broke
userspace compatibilty. When specifying a rule with "from all"
or "to all", iproute adds a zero byte long netlink attribute,
but the policy requires all addresses to have a size equal to
sizeof(struct in_addr)/sizeof(struct in6_addr), resulting in a
validation error.
Check attribute length of FRA_SRC/FRA_DST in the generic framework
by letting the family specific rules implementation provide the
length of an address. Report an error if address length is non
zero but no address attribute is provided. Fix actual bug by
checking address length for non-zero instead of relying on
availability of attribute.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/net/fib_rules.h | 1 +
net/core/fib_rules.c | 30 ++++++++++++++++++++++++++++++
net/decnet/dn_rules.c | 13 ++++++-------
net/ipv4/fib_rules.c | 14 ++++++--------
net/ipv6/fib6_rules.c | 14 +++++---------
5 files changed, 48 insertions(+), 24 deletions(-)
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -34,6 +34,7 @@ struct fib_rules_ops
int family;
struct list_head list;
int rule_size;
+ int addr_size;
int (*action)(struct fib_rule *,
struct flowi *, int,
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -152,6 +152,28 @@ out:
EXPORT_SYMBOL_GPL(fib_rules_lookup);
+static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
+ struct fib_rules_ops *ops)
+{
+ int err = -EINVAL;
+
+ if (frh->src_len)
+ if (tb[FRA_SRC] == NULL ||
+ frh->src_len > (ops->addr_size * 8) ||
+ nla_len(tb[FRA_SRC]) != ops->addr_size)
+ goto errout;
+
+ if (frh->dst_len)
+ if (tb[FRA_DST] == NULL ||
+ frh->dst_len > (ops->addr_size * 8) ||
+ nla_len(tb[FRA_DST]) != ops->addr_size)
+ goto errout;
+
+ err = 0;
+errout:
+ return err;
+}
+
int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
{
struct fib_rule_hdr *frh = nlmsg_data(nlh);
@@ -173,6 +195,10 @@ int fib_nl_newrule(struct sk_buff *skb,
if (err < 0)
goto errout;
+ err = validate_rulemsg(frh, tb, ops);
+ if (err < 0)
+ goto errout;
+
rule = kzalloc(ops->rule_size, GFP_KERNEL);
if (rule == NULL) {
err = -ENOMEM;
@@ -260,6 +286,10 @@ int fib_nl_delrule(struct sk_buff *skb,
if (err < 0)
goto errout;
+ err = validate_rulemsg(frh, tb, ops);
+ if (err < 0)
+ goto errout;
+
list_for_each_entry(rule, ops->rules_list, list) {
if (frh->action && (frh->action != rule->action))
continue;
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -109,8 +109,6 @@ errout:
static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
FRA_GENERIC_POLICY,
- [FRA_SRC] = { .type = NLA_U16 },
- [FRA_DST] = { .type = NLA_U16 },
};
static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
@@ -133,7 +131,7 @@ static int dn_fib_rule_configure(struct
int err = -EINVAL;
struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
- if (frh->src_len > 16 || frh->dst_len > 16 || frh->tos)
+ if (frh->tos)
goto errout;
if (rule->table == RT_TABLE_UNSPEC) {
@@ -150,10 +148,10 @@ static int dn_fib_rule_configure(struct
}
}
- if (tb[FRA_SRC])
+ if (frh->src_len)
r->src = nla_get_le16(tb[FRA_SRC]);
- if (tb[FRA_DST])
+ if (frh->dst_len)
r->dst = nla_get_le16(tb[FRA_DST]);
r->src_len = frh->src_len;
@@ -176,10 +174,10 @@ static int dn_fib_rule_compare(struct fi
if (frh->dst_len && (r->dst_len != frh->dst_len))
return 0;
- if (tb[FRA_SRC] && (r->src != nla_get_le16(tb[FRA_SRC])))
+ if (frh->src_len && (r->src != nla_get_le16(tb[FRA_SRC])))
return 0;
- if (tb[FRA_DST] && (r->dst != nla_get_le16(tb[FRA_DST])))
+ if (frh->dst_len && (r->dst != nla_get_le16(tb[FRA_DST])))
return 0;
return 1;
@@ -249,6 +247,7 @@ int dn_fib_dump_rules(struct sk_buff *sk
static struct fib_rules_ops dn_fib_rules_ops = {
.family = AF_DECnet,
.rule_size = sizeof(struct dn_fib_rule),
+ .addr_size = sizeof(u16),
.action = dn_fib_rule_action,
.match = dn_fib_rule_match,
.configure = dn_fib_rule_configure,
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -171,8 +171,6 @@ static struct fib_table *fib_empty_table
static struct nla_policy fib4_rule_policy[FRA_MAX+1] __read_mostly = {
FRA_GENERIC_POLICY,
- [FRA_SRC] = { .type = NLA_U32 },
- [FRA_DST] = { .type = NLA_U32 },
[FRA_FLOW] = { .type = NLA_U32 },
};
@@ -183,8 +181,7 @@ static int fib4_rule_configure(struct fi
int err = -EINVAL;
struct fib4_rule *rule4 = (struct fib4_rule *) rule;
- if (frh->src_len > 32 || frh->dst_len > 32 ||
- (frh->tos & ~IPTOS_TOS_MASK))
+ if (frh->tos & ~IPTOS_TOS_MASK)
goto errout;
if (rule->table == RT_TABLE_UNSPEC) {
@@ -201,10 +198,10 @@ static int fib4_rule_configure(struct fi
}
}
- if (tb[FRA_SRC])
+ if (frh->src_len)
rule4->src = nla_get_be32(tb[FRA_SRC]);
- if (tb[FRA_DST])
+ if (frh->dst_len)
rule4->dst = nla_get_be32(tb[FRA_DST]);
#ifdef CONFIG_NET_CLS_ROUTE
@@ -242,10 +239,10 @@ static int fib4_rule_compare(struct fib_
return 0;
#endif
- if (tb[FRA_SRC] && (rule4->src != nla_get_be32(tb[FRA_SRC])))
+ if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC])))
return 0;
- if (tb[FRA_DST] && (rule4->dst != nla_get_be32(tb[FRA_DST])))
+ if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST])))
return 0;
return 1;
@@ -309,6 +306,7 @@ static size_t fib4_rule_nlmsg_payload(st
static struct fib_rules_ops fib4_rules_ops = {
.family = AF_INET,
.rule_size = sizeof(struct fib4_rule),
+ .addr_size = sizeof(u32),
.action = fib4_rule_action,
.match = fib4_rule_match,
.configure = fib4_rule_configure,
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_ru
static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
FRA_GENERIC_POLICY,
- [FRA_SRC] = { .len = sizeof(struct in6_addr) },
- [FRA_DST] = { .len = sizeof(struct in6_addr) },
};
static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fi
int err = -EINVAL;
struct fib6_rule *rule6 = (struct fib6_rule *) rule;
- if (frh->src_len > 128 || frh->dst_len > 128)
- goto errout;
-
if (rule->action == FR_ACT_TO_TBL) {
if (rule->table == RT6_TABLE_UNSPEC)
goto errout;
@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fi
}
}
- if (tb[FRA_SRC])
+ if (frh->src_len)
nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
sizeof(struct in6_addr));
- if (tb[FRA_DST])
+ if (frh->dst_len)
nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
sizeof(struct in6_addr));
@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_
if (frh->tos && (rule6->tclass != frh->tos))
return 0;
- if (tb[FRA_SRC] &&
+ if (frh->src_len &&
nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
return 0;
- if (tb[FRA_DST] &&
+ if (frh->dst_len &&
nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
return 0;
@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(st
static struct fib_rules_ops fib6_rules_ops = {
.family = AF_INET6,
.rule_size = sizeof(struct fib6_rule),
+ .addr_size = sizeof(struct in6_addr),
.action = fib6_rule_action,
.match = fib6_rule_match,
.configure = fib6_rule_configure,
--
next prev parent reply other threads:[~2007-03-30 21:21 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20070330205938.984247529@mini.kroah.org>
2007-03-30 21:03 ` [patch 00/37] 2.6.20-stable review Greg KH
2007-03-30 21:03 ` [patch 01/37] ide: clear bmdma status in ide_intr() for ICHx controllers (revised #4) Greg KH
2007-03-30 21:03 ` [patch 02/37] ide: remove clearing bmdma status from cdrom_decode_status() (rev #4) Greg KH
2007-03-30 21:03 ` [patch 03/37] sata_nv: delay on switching between NCQ and non-NCQ commands Greg KH
2007-03-30 21:04 ` [patch 04/37] UML - fix epoll Greg KH
2007-03-30 21:04 ` [patch 05/37] UML - host VDSO fix Greg KH
2007-03-30 21:04 ` [patch 06/37] UML - Fix static linking Greg KH
2007-03-30 21:04 ` Greg KH
2007-03-31 1:21 ` [uml-devel] " Blaisorblade
2007-03-30 21:04 ` [patch 07/37] UML - use correct register file size everywhere Greg KH
2007-03-30 21:04 ` [patch 08/37] uml: fix unreasonably long udelay Greg KH
2007-03-30 21:04 ` [patch 09/37] ieee1394: dv1394: fix CardBus card ejection Greg KH
2007-03-30 21:04 ` [patch 10/37] NET: Fix packet classidier NULL pointer OOPS Greg KH
2007-03-30 21:04 ` [patch 11/37] NET_SCHED: Fix ingress qdisc locking Greg KH
2007-03-30 21:04 ` [patch 12/37] IPV6: Fix ipv6 round-robin locking Greg KH
2007-03-30 21:04 ` [patch 13/37] PPP: Fix PPP skb leak Greg KH
2007-03-30 21:04 ` [patch 14/37] DCCP: Fix exploitable hole in DCCP socket options Greg KH
2007-03-30 21:04 ` [patch 15/37] VIDEO: Fix FFB DAC revision probing Greg KH
2007-03-30 21:04 ` [patch 16/37] NET: Fix sock_attach_fd() failure in sys_accept() Greg KH
2007-03-30 21:04 ` Greg KH
2007-03-30 21:04 ` [patch 17/37] SPARC: Fix sparc builds with gcc-4.2.x Greg KH
2007-03-30 21:05 ` [patch 18/37] Fix decnet endianness Greg KH
2007-03-30 21:05 ` Greg KH [this message]
2007-03-30 21:05 ` [patch 20/37] DVB: fix nxt200x rf input switching Greg KH
2007-03-30 21:05 ` [patch 21/37] V4L: radio: Fix error in Kbuild file Greg KH
2007-03-30 21:05 ` [patch 22/37] V4L: Fix SECAM handling on saa7115 Greg KH
2007-03-30 21:06 ` [patch 23/37] V4L: msp_attach must return 0 if no msp3400 was found Greg KH
2007-03-30 21:06 ` [patch 24/37] DVB: isl6421: dont reference freed memory Greg KH
2007-03-30 21:06 ` [patch 25/37] dvb-core: fix several locking related problems Greg KH
2007-03-30 21:06 ` [patch 26/37] V4L: saa7146: Fix allocation of clipping memory Greg KH
2007-03-30 21:06 ` [patch 27/37] jmicron: make ide jmicron driver play nice with libata ones Greg KH
2007-03-30 21:06 ` [patch 28/37] i2o: block IO errors on i2o disk Greg KH
2007-03-30 21:06 ` [patch 29/37] ide: revert "ide: fix drive side 80c cable check, take 2" for now Greg KH
2007-03-30 21:06 ` [patch 30/37] CIFS: Allow reset of file to ATTR_NORMAL when archive bit not set Greg KH
2007-03-30 21:06 ` [patch 31/37] CIFS: reset mode when client notices that ATTR_READONLY is no longer set Greg KH
2007-03-30 21:06 ` [patch 32/37] CRYPTO: api: scatterwalk_copychunks() fails to advance through scatterlist Greg KH
2007-03-31 1:41 ` Patrick McHardy
2007-03-31 2:14 ` Herbert Xu
2007-03-31 2:31 ` Patrick McHardy
2007-03-31 3:11 ` Greg KH
2007-03-31 3:45 ` Herbert Xu
2007-03-31 21:35 ` J. Bruce Fields
2007-03-30 21:06 ` [patch 33/37] libata: clear TF before IDENTIFYing Greg KH
2007-03-30 21:06 ` [patch 34/37] libata bugfix: HDIO_DRIVE_TASK Greg KH
2007-03-30 21:42 ` Mark Lord
2007-03-30 21:59 ` Greg KH
2007-03-30 21:45 ` libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK Mark Lord
2007-03-31 3:36 ` Tejun Heo
2007-03-31 16:55 ` Mark Lord
2007-03-31 17:05 ` Tejun Heo
2007-04-04 6:08 ` Jeff Garzik
2007-03-30 21:07 ` [patch 35/37] libata: sata_mv: dont touch reserved bits in EDMA config register Greg KH
2007-03-30 21:07 ` [patch 36/37] libata: sata_mv: Fix 50xx irq mask Greg KH
2007-03-30 21:07 ` [patch 37/37] generic_serial: fix decoding of baud rate Greg KH
2007-03-30 21:10 ` [patch 00/37] 2.6.20-stable review Greg KH
2007-04-04 14:28 ` Chuck Ebbert
2007-04-04 21:23 ` [stable] " Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070330210506.GV29450@kroah.com \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=bunk@stusta.de \
--cc=cebbert@redhat.com \
--cc=chuckw@quantumlinux.com \
--cc=davej@redhat.com \
--cc=davem@davemloft.net \
--cc=jmforbes@linuxtx.org \
--cc=kaber@trash.net \
--cc=linux-kernel@vger.kernel.org \
--cc=mkrufky@linuxtv.org \
--cc=rdunlap@xenotime.net \
--cc=reviews@ml.cw.f00f.org \
--cc=stable@kernel.org \
--cc=tgraf@suug.ch \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox