Commit 8b4c3cdd authored by David Ahern's avatar David Ahern Committed by David S. Miller
Browse files

net: sched: Add policy validation for tc attributes 



A number of TC attributes are processed without proper validation
(e.g., length checks). Add a tca policy for all input attributes and use
when invoking nlmsg_parse.

The 2 Fixes tags below cover the latest additions. The other attributes
are a string (KIND), nested attribute (OPTIONS which does seem to have
validation in most cases), for dumps only or a flag.

Fixes: 5bc17018 ("net: sched: introduce multichain support for filters")
Fixes: d47a6b0e ("net: sched: introduce ingress/egress block index attributes for qdisc")
Signed-off-by: default avatarDavid Ahern <dsahern@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent bd961c9b

net/sched/sch_api.c

+20 −4
Original line number Diff line number Diff line
@@ -1311,6 +1311,18 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w) 
 * Delete/get qdisc.

 */



const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {

	[TCA_KIND]		= { .type = NLA_STRING },

	[TCA_OPTIONS]		= { .type = NLA_NESTED },

	[TCA_RATE]		= { .type = NLA_BINARY,

				    .len = sizeof(struct tc_estimator) },

	[TCA_STAB]		= { .type = NLA_NESTED },

	[TCA_DUMP_INVISIBLE]	= { .type = NLA_FLAG },

	[TCA_CHAIN]		= { .type = NLA_U32 },

	[TCA_INGRESS_BLOCK]	= { .type = NLA_U32 },

	[TCA_EGRESS_BLOCK]	= { .type = NLA_U32 },

};



static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,

			struct netlink_ext_ack *extack)

{
@@ -1327,7 +1339,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, 
	    !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))

		return -EPERM;



	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);

	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,

			  extack);

	if (err < 0)

		return err;
@@ -1411,7 +1424,8 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, 


replay:

	/* Reinit, just in case something touches this. */

	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);

	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,

			  extack);

	if (err < 0)

		return err;
@@ -1645,7 +1659,8 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb) 
	idx = 0;

	ASSERT_RTNL();



	err = nlmsg_parse(nlh, sizeof(struct tcmsg), tca, TCA_MAX, NULL, NULL);

	err = nlmsg_parse(nlh, sizeof(struct tcmsg), tca, TCA_MAX,

			  rtm_tca_policy, NULL);

	if (err < 0)

		return err;
@@ -1864,7 +1879,8 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n, 
	    !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))

		return -EPERM;



	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);

	err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,

			  extack);

	if (err < 0)

		return err;

CRA Git | Maintained and supported by SUSTech CRA and CCSE