Commit fbc2e7d9 authored by Changli Gao's avatar Changli Gao Committed by David S. Miller

cls_u32: use skb_header_pointer() to dereference data safely

use skb_header_pointer() to dereference data safely

the original skb->data dereference isn't safe, as there isn't any skb->len or
skb_is_nonlinear() check. skb_header_pointer() is used instead in this patch.
And when the skb isn't long enough, we terminate the function u32_classify()
immediately with -1.
Signed-off-by: default avatarChangli Gao <xiaosuo@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent edafe502
...@@ -98,11 +98,11 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re ...@@ -98,11 +98,11 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
{ {
struct { struct {
struct tc_u_knode *knode; struct tc_u_knode *knode;
u8 *ptr; unsigned int off;
} stack[TC_U32_MAXDEPTH]; } stack[TC_U32_MAXDEPTH];
struct tc_u_hnode *ht = (struct tc_u_hnode*)tp->root; struct tc_u_hnode *ht = (struct tc_u_hnode*)tp->root;
u8 *ptr = skb_network_header(skb); unsigned int off = skb_network_offset(skb);
struct tc_u_knode *n; struct tc_u_knode *n;
int sdepth = 0; int sdepth = 0;
int off2 = 0; int off2 = 0;
...@@ -134,8 +134,14 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re ...@@ -134,8 +134,14 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
#endif #endif
for (i = n->sel.nkeys; i>0; i--, key++) { for (i = n->sel.nkeys; i>0; i--, key++) {
unsigned int toff;
if ((*(__be32*)(ptr+key->off+(off2&key->offmask))^key->val)&key->mask) { __be32 *data, _data;
toff = off + key->off + (off2 & key->offmask);
data = skb_header_pointer(skb, toff, 4, &_data);
if (!data)
goto out;
if ((*data ^ key->val) & key->mask) {
n = n->next; n = n->next;
goto next_knode; goto next_knode;
} }
...@@ -174,29 +180,45 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re ...@@ -174,29 +180,45 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
if (sdepth >= TC_U32_MAXDEPTH) if (sdepth >= TC_U32_MAXDEPTH)
goto deadloop; goto deadloop;
stack[sdepth].knode = n; stack[sdepth].knode = n;
stack[sdepth].ptr = ptr; stack[sdepth].off = off;
sdepth++; sdepth++;
ht = n->ht_down; ht = n->ht_down;
sel = 0; sel = 0;
if (ht->divisor) if (ht->divisor) {
sel = ht->divisor&u32_hash_fold(*(__be32*)(ptr+n->sel.hoff), &n->sel,n->fshift); __be32 *data, _data;
data = skb_header_pointer(skb, off + n->sel.hoff, 4,
&_data);
if (!data)
goto out;
sel = ht->divisor & u32_hash_fold(*data, &n->sel,
n->fshift);
}
if (!(n->sel.flags&(TC_U32_VAROFFSET|TC_U32_OFFSET|TC_U32_EAT))) if (!(n->sel.flags&(TC_U32_VAROFFSET|TC_U32_OFFSET|TC_U32_EAT)))
goto next_ht; goto next_ht;
if (n->sel.flags&(TC_U32_OFFSET|TC_U32_VAROFFSET)) { if (n->sel.flags&(TC_U32_OFFSET|TC_U32_VAROFFSET)) {
off2 = n->sel.off + 3; off2 = n->sel.off + 3;
if (n->sel.flags&TC_U32_VAROFFSET) if (n->sel.flags & TC_U32_VAROFFSET) {
off2 += ntohs(n->sel.offmask & *(__be16*)(ptr+n->sel.offoff)) >>n->sel.offshift; __be16 *data, _data;
data = skb_header_pointer(skb,
off + n->sel.offoff,
2, &_data);
if (!data)
goto out;
off2 += ntohs(n->sel.offmask & *data) >>
n->sel.offshift;
}
off2 &= ~3; off2 &= ~3;
} }
if (n->sel.flags&TC_U32_EAT) { if (n->sel.flags&TC_U32_EAT) {
ptr += off2; off += off2;
off2 = 0; off2 = 0;
} }
if (ptr < skb_tail_pointer(skb)) if (off < skb->len)
goto next_ht; goto next_ht;
} }
...@@ -204,9 +226,10 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re ...@@ -204,9 +226,10 @@ static int u32_classify(struct sk_buff *skb, struct tcf_proto *tp, struct tcf_re
if (sdepth--) { if (sdepth--) {
n = stack[sdepth].knode; n = stack[sdepth].knode;
ht = n->ht_up; ht = n->ht_up;
ptr = stack[sdepth].ptr; off = stack[sdepth].off;
goto check_terminal; goto check_terminal;
} }
out:
return -1; return -1;
deadloop: deadloop:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment