[PATCH net] net: sched: cls_flower: validate nested enc_opts_policy to avoid build warning

[PATCH net] net: sched: cls_flower: validate nested enc_opts_policy to avoid build warning

[Jakub Kicinski]

TCA_FLOWER_KEY_ENC_OPTS and TCA_FLOWER_KEY_ENC_OPTS_MASK can only
currently contain further nested attributes, which are parsed by
hand, so the policy is never actually used.  Add the validation
anyway to avoid potential bugs when other attributes are added
and to make the attribute structure slightly more clear.  Validation
will also set extact to point to bad attribute on error.

Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: Simon Horman <simon.horman@netronome.com>
---
 net/sched/cls_flower.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 9aada2d0ef06..c6c327874abc 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -709,11 +709,23 @@ static int fl_set_enc_opt(struct nlattr **tb, struct fl_flow_key *key,
 			  struct netlink_ext_ack *extack)
 {
 	const struct nlattr *nla_enc_key, *nla_opt_key, *nla_opt_msk = NULL;
-	int option_len, key_depth, msk_depth = 0;
+	int err, option_len, key_depth, msk_depth = 0;
+
+	err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS],
+				  TCA_FLOWER_KEY_ENC_OPTS_MAX,
+				  enc_opts_policy, extack);
+	if (err)
+		return err;
 
 	nla_enc_key = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS]);
 
 	if (tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]) {
+		err = nla_validate_nested(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK],
+					  TCA_FLOWER_KEY_ENC_OPTS_MAX,
+					  enc_opts_policy, extack);
+		if (err)
+			return err;
+
 		nla_opt_msk = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
 		msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
 	}
-- 
2.17.1

Re: [PATCH net] net: sched: cls_flower: validate nested enc_opts_policy to avoid build warning

[David Miller]

From: Jakub Kicinski <jakub.kicinski@netronome.com>
Date: Fri,  9 Nov 2018 14:41:22 -0800

> TCA_FLOWER_KEY_ENC_OPTS and TCA_FLOWER_KEY_ENC_OPTS_MASK can only
> currently contain further nested attributes, which are parsed by
> hand, so the policy is never actually used.  Add the validation
> anyway to avoid potential bugs when other attributes are added
> and to make the attribute structure slightly more clear.  Validation
> will also set extact to point to bad attribute on error.
> 
> Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
> Acked-by: Simon Horman <simon.horman@netronome.com>

If this fixes a build warning, please include the build warning
message in your commit log.

Thanks!

Re: [PATCH net] net: sched: cls_flower: validate nested enc_opts_policy to avoid build warning

[Jakub Kicinski]

On Fri, 09 Nov 2018 20:40:25 -0800 (PST), David Miller wrote:
> From: Jakub Kicinski <jakub.kicinski@netronome.com>
> Date: Fri,  9 Nov 2018 14:41:22 -0800
> 
> > TCA_FLOWER_KEY_ENC_OPTS and TCA_FLOWER_KEY_ENC_OPTS_MASK can only
> > currently contain further nested attributes, which are parsed by
> > hand, so the policy is never actually used.  Add the validation
> > anyway to avoid potential bugs when other attributes are added
> > and to make the attribute structure slightly more clear.  Validation
> > will also set extact to point to bad attribute on error.
> > 
> > Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
> > Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
> > Acked-by: Simon Horman <simon.horman@netronome.com>  
> 
> If this fixes a build warning, please include the build warning
> message in your commit log.
> 
> Thanks!

Ah, sorry, it's a W=1 warning, which should have been mentioned, too.
I'll repost shortly!