Code Review
/
kvmfornfv.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
review
|
tree
raw
|
inline
| side by side
Upgrade to 4.4.50-rt62
[kvmfornfv.git]
/
kernel
/
net
/
sched
/
act_pedit.c
diff --git
a/kernel/net/sched/act_pedit.c
b/kernel/net/sched/act_pedit.c
index
e38a770
..
c3434e9
100644
(file)
--- a/
kernel/net/sched/act_pedit.c
+++ b/
kernel/net/sched/act_pedit.c
@@
-104,6
+104,17
@@
static void tcf_pedit_cleanup(struct tc_action *a, int bind)
kfree(keys);
}
kfree(keys);
}
+static bool offset_valid(struct sk_buff *skb, int offset)
+{
+ if (offset > 0 && offset > skb->len)
+ return false;
+
+ if (offset < 0 && -offset > skb_headroom(skb))
+ return false;
+
+ return true;
+}
+
static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
struct tcf_result *res)
{
static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
struct tcf_result *res)
{
@@
-130,6
+141,11
@@
static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
if (tkey->offmask) {
char *d, _d;
if (tkey->offmask) {
char *d, _d;
+ if (!offset_valid(skb, off + tkey->at)) {
+ pr_info("tc filter pedit 'at' offset %d out of bounds\n",
+ off + tkey->at);
+ goto bad;
+ }
d = skb_header_pointer(skb, off + tkey->at, 1,
&_d);
if (!d)
d = skb_header_pointer(skb, off + tkey->at, 1,
&_d);
if (!d)
@@
-142,10
+158,10
@@
static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
" offset must be on 32 bit boundaries\n");
goto bad;
}
" offset must be on 32 bit boundaries\n");
goto bad;
}
- if (offset > 0 && offset > skb->len) {
- pr_info("tc filter pedit"
-
" offset %d can't exceed pkt length %d
\n",
-
offset, skb->len
);
+
+ if (!offset_valid(skb, off + offset)) {
+
pr_info("tc filter pedit offset %d out of bounds
\n",
+
offset
);
goto bad;
}
goto bad;
}