Skip to content

L
linux
Commit 6fa8c014 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files
Options

[NET_SCHED]: Use nla_policy for attribute validation in classifiers 

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 27a3421e
Hide whitespace changes
Inline Side-by-side
Showing with 59 additions and 68 deletions
net/sched/cls_basic.c
View file @ 6fa8c014
...@@ -129,6 +129,11 @@ static int basic_delete(struct tcf_proto *tp, unsigned long arg) ...@@ -129,6 +129,11 @@ static int basic_delete(struct tcf_proto *tp, unsigned long arg)
return -ENOENT; return -ENOENT;
} }
static const struct nla_policy basic_policy[TCA_BASIC_MAX + 1] = {
[TCA_BASIC_CLASSID] = { .type = NLA_U32 },
[TCA_BASIC_EMATCHES] = { .type = NLA_NESTED },
};
static inline int basic_set_parms(struct tcf_proto *tp, struct basic_filter *f, static inline int basic_set_parms(struct tcf_proto *tp, struct basic_filter *f,
unsigned long base, struct nlattr **tb, unsigned long base, struct nlattr **tb,
struct nlattr *est) struct nlattr *est)
...@@ -137,10 +142,6 @@ static inline int basic_set_parms(struct tcf_proto *tp, struct basic_filter *f, ...@@ -137,10 +142,6 @@ static inline int basic_set_parms(struct tcf_proto *tp, struct basic_filter *f,
struct tcf_exts e; struct tcf_exts e;
struct tcf_ematch_tree t; struct tcf_ematch_tree t;
if (tb[TCA_BASIC_CLASSID])
if (nla_len(tb[TCA_BASIC_CLASSID]) < sizeof(u32))
return err;
err = tcf_exts_validate(tp, tb, est, &e, &basic_ext_map); err = tcf_exts_validate(tp, tb, est, &e, &basic_ext_map);
if (err < 0) if (err < 0)
return err; return err;
...@@ -174,7 +175,8 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle, ...@@ -174,7 +175,8 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
if (tca[TCA_OPTIONS] == NULL) if (tca[TCA_OPTIONS] == NULL)
return -EINVAL; return -EINVAL;
err = nla_parse_nested(tb, TCA_BASIC_MAX, tca[TCA_OPTIONS], NULL); err = nla_parse_nested(tb, TCA_BASIC_MAX, tca[TCA_OPTIONS],
basic_policy);
if (err < 0) if (err < 0)
return err; return err;
......
net/sched/cls_fw.c
View file @ 6fa8c014
...@@ -186,6 +186,12 @@ static int fw_delete(struct tcf_proto *tp, unsigned long arg) ...@@ -186,6 +186,12 @@ static int fw_delete(struct tcf_proto *tp, unsigned long arg)
return -EINVAL; return -EINVAL;
} }
static const struct nla_policy fw_policy[TCA_FW_MAX + 1] = {
[TCA_FW_CLASSID] = { .type = NLA_U32 },
[TCA_FW_INDEV] = { .type = NLA_STRING, .len = IFNAMSIZ },
[TCA_FW_MASK] = { .type = NLA_U32 },
};
static int static int
fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f, fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f,
struct nlattr **tb, struct nlattr **tca, unsigned long base) struct nlattr **tb, struct nlattr **tca, unsigned long base)
...@@ -201,8 +207,6 @@ fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f, ...@@ -201,8 +207,6 @@ fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f,
err = -EINVAL; err = -EINVAL;
if (tb[TCA_FW_CLASSID]) { if (tb[TCA_FW_CLASSID]) {
if (nla_len(tb[TCA_FW_CLASSID]) != sizeof(u32))
goto errout;
f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]);
tcf_bind_filter(tp, &f->res, base); tcf_bind_filter(tp, &f->res, base);
} }
...@@ -216,8 +220,6 @@ fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f, ...@@ -216,8 +220,6 @@ fw_change_attrs(struct tcf_proto *tp, struct fw_filter *f,
#endif /* CONFIG_NET_CLS_IND */ #endif /* CONFIG_NET_CLS_IND */
if (tb[TCA_FW_MASK]) { if (tb[TCA_FW_MASK]) {
if (nla_len(tb[TCA_FW_MASK]) != sizeof(u32))
goto errout;
mask = nla_get_u32(tb[TCA_FW_MASK]); mask = nla_get_u32(tb[TCA_FW_MASK]);
if (mask != head->mask) if (mask != head->mask)
goto errout; goto errout;
...@@ -246,7 +248,7 @@ static int fw_change(struct tcf_proto *tp, unsigned long base, ...@@ -246,7 +248,7 @@ static int fw_change(struct tcf_proto *tp, unsigned long base,
if (!opt) if (!opt)
return handle ? -EINVAL : 0; return handle ? -EINVAL : 0;
err = nla_parse_nested(tb, TCA_FW_MAX, opt, NULL); err = nla_parse_nested(tb, TCA_FW_MAX, opt, fw_policy);
if (err < 0) if (err < 0)
return err; return err;
...@@ -261,11 +263,8 @@ static int fw_change(struct tcf_proto *tp, unsigned long base, ...@@ -261,11 +263,8 @@ static int fw_change(struct tcf_proto *tp, unsigned long base,
if (head == NULL) { if (head == NULL) {
u32 mask = 0xFFFFFFFF; u32 mask = 0xFFFFFFFF;
if (tb[TCA_FW_MASK]) { if (tb[TCA_FW_MASK])
if (nla_len(tb[TCA_FW_MASK]) != sizeof(u32))
return -EINVAL;
mask = nla_get_u32(tb[TCA_FW_MASK]); mask = nla_get_u32(tb[TCA_FW_MASK]);
}
head = kzalloc(sizeof(struct fw_head), GFP_KERNEL); head = kzalloc(sizeof(struct fw_head), GFP_KERNEL);
if (head == NULL) if (head == NULL)
......
net/sched/cls_route.c
View file @ 6fa8c014
...@@ -323,6 +323,13 @@ static int route4_delete(struct tcf_proto *tp, unsigned long arg) ...@@ -323,6 +323,13 @@ static int route4_delete(struct tcf_proto *tp, unsigned long arg)
return 0; return 0;
} }
static const struct nla_policy route4_policy[TCA_ROUTE4_MAX + 1] = {
[TCA_ROUTE4_CLASSID] = { .type = NLA_U32 },
[TCA_ROUTE4_TO] = { .type = NLA_U32 },
[TCA_ROUTE4_FROM] = { .type = NLA_U32 },
[TCA_ROUTE4_IIF] = { .type = NLA_U32 },
};
static int route4_set_parms(struct tcf_proto *tp, unsigned long base, static int route4_set_parms(struct tcf_proto *tp, unsigned long base,
struct route4_filter *f, u32 handle, struct route4_head *head, struct route4_filter *f, u32 handle, struct route4_head *head,
struct nlattr **tb, struct nlattr *est, int new) struct nlattr **tb, struct nlattr *est, int new)
...@@ -339,15 +346,9 @@ static int route4_set_parms(struct tcf_proto *tp, unsigned long base, ...@@ -339,15 +346,9 @@ static int route4_set_parms(struct tcf_proto *tp, unsigned long base,
return err; return err;
err = -EINVAL; err = -EINVAL;
if (tb[TCA_ROUTE4_CLASSID])
if (nla_len(tb[TCA_ROUTE4_CLASSID]) < sizeof(u32))
goto errout;
if (tb[TCA_ROUTE4_TO]) { if (tb[TCA_ROUTE4_TO]) {
if (new && handle & 0x8000) if (new && handle & 0x8000)
goto errout; goto errout;
if (nla_len(tb[TCA_ROUTE4_TO]) < sizeof(u32))
goto errout;
to = nla_get_u32(tb[TCA_ROUTE4_TO]); to = nla_get_u32(tb[TCA_ROUTE4_TO]);
if (to > 0xFF) if (to > 0xFF)
goto errout; goto errout;
...@@ -357,15 +358,11 @@ static int route4_set_parms(struct tcf_proto *tp, unsigned long base, ...@@ -357,15 +358,11 @@ static int route4_set_parms(struct tcf_proto *tp, unsigned long base,
if (tb[TCA_ROUTE4_FROM]) { if (tb[TCA_ROUTE4_FROM]) {
if (tb[TCA_ROUTE4_IIF]) if (tb[TCA_ROUTE4_IIF])
goto errout; goto errout;
if (nla_len(tb[TCA_ROUTE4_FROM]) < sizeof(u32))
goto errout;
id = nla_get_u32(tb[TCA_ROUTE4_FROM]); id = nla_get_u32(tb[TCA_ROUTE4_FROM]);
if (id > 0xFF) if (id > 0xFF)
goto errout; goto errout;
nhandle |= id << 16; nhandle |= id << 16;
} else if (tb[TCA_ROUTE4_IIF]) { } else if (tb[TCA_ROUTE4_IIF]) {
if (nla_len(tb[TCA_ROUTE4_IIF]) < sizeof(u32))
goto errout;
id = nla_get_u32(tb[TCA_ROUTE4_IIF]); id = nla_get_u32(tb[TCA_ROUTE4_IIF]);
if (id > 0x7FFF) if (id > 0x7FFF)
goto errout; goto errout;
...@@ -440,7 +437,7 @@ static int route4_change(struct tcf_proto *tp, unsigned long base, ...@@ -440,7 +437,7 @@ static int route4_change(struct tcf_proto *tp, unsigned long base,
if (opt == NULL) if (opt == NULL)
return handle ? -EINVAL : 0; return handle ? -EINVAL : 0;
err = nla_parse_nested(tb, TCA_ROUTE4_MAX, opt, NULL); err = nla_parse_nested(tb, TCA_ROUTE4_MAX, opt, route4_policy);
if (err < 0) if (err < 0)
return err; return err;
......
net/sched/cls_rsvp.h
View file @ 6fa8c014
...@@ -397,6 +397,15 @@ static u32 gen_tunnel(struct rsvp_head *data) ...@@ -397,6 +397,15 @@ static u32 gen_tunnel(struct rsvp_head *data)
return 0; return 0;
} }
static const struct nla_policy rsvp_policy[TCA_RSVP_MAX + 1] = {
[TCA_RSVP_CLASSID] = { .type = NLA_U32 },
[TCA_RSVP_DST] = { .type = NLA_BINARY,
.len = RSVP_DST_LEN * sizeof(u32) },
[TCA_RSVP_SRC] = { .type = NLA_BINARY,
.len = RSVP_DST_LEN * sizeof(u32) },
[TCA_RSVP_PINFO] = { .len = sizeof(struct tc_rsvp_pinfo) },
};
static int rsvp_change(struct tcf_proto *tp, unsigned long base, static int rsvp_change(struct tcf_proto *tp, unsigned long base,
u32 handle, u32 handle,
struct nlattr **tca, struct nlattr **tca,
...@@ -416,7 +425,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base, ...@@ -416,7 +425,7 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
if (opt == NULL) if (opt == NULL)
return handle ? -EINVAL : 0; return handle ? -EINVAL : 0;
err = nla_parse_nested(tb, TCA_RSVP_MAX, opt, NULL); err = nla_parse_nested(tb, TCA_RSVP_MAX, opt, rsvp_policy);
if (err < 0) if (err < 0)
return err; return err;
...@@ -452,30 +461,17 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base, ...@@ -452,30 +461,17 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
h2 = 16; h2 = 16;
if (tb[TCA_RSVP_SRC-1]) { if (tb[TCA_RSVP_SRC-1]) {
err = -EINVAL;
if (nla_len(tb[TCA_RSVP_SRC-1]) != sizeof(f->src))
goto errout;
memcpy(f->src, nla_data(tb[TCA_RSVP_SRC-1]), sizeof(f->src)); memcpy(f->src, nla_data(tb[TCA_RSVP_SRC-1]), sizeof(f->src));
h2 = hash_src(f->src); h2 = hash_src(f->src);
} }
if (tb[TCA_RSVP_PINFO-1]) { if (tb[TCA_RSVP_PINFO-1]) {
err = -EINVAL;
if (nla_len(tb[TCA_RSVP_PINFO-1]) < sizeof(struct tc_rsvp_pinfo))
goto errout;
pinfo = nla_data(tb[TCA_RSVP_PINFO-1]); pinfo = nla_data(tb[TCA_RSVP_PINFO-1]);
f->spi = pinfo->spi; f->spi = pinfo->spi;
f->tunnelhdr = pinfo->tunnelhdr; f->tunnelhdr = pinfo->tunnelhdr;
} }
if (tb[TCA_RSVP_CLASSID-1]) { if (tb[TCA_RSVP_CLASSID-1])
err = -EINVAL;
if (nla_len(tb[TCA_RSVP_CLASSID-1]) != 4)
goto errout;
f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID-1]); f->res.classid = nla_get_u32(tb[TCA_RSVP_CLASSID-1]);
}
err = -EINVAL;
if (nla_len(tb[TCA_RSVP_DST-1]) != sizeof(f->src))
goto errout;
dst = nla_data(tb[TCA_RSVP_DST-1]); dst = nla_data(tb[TCA_RSVP_DST-1]);
h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0); h1 = hash_dst(dst, pinfo ? pinfo->protocol : 0, pinfo ? pinfo->tunnelid : 0);
......
net/sched/cls_tcindex.c
View file @ 6fa8c014
...@@ -193,6 +193,14 @@ valid_perfect_hash(struct tcindex_data *p) ...@@ -193,6 +193,14 @@ valid_perfect_hash(struct tcindex_data *p)
return p->hash > (p->mask >> p->shift); return p->hash > (p->mask >> p->shift);
} }
static const struct nla_policy tcindex_policy[TCA_TCINDEX_MAX + 1] = {
[TCA_TCINDEX_HASH] = { .type = NLA_U32 },
[TCA_TCINDEX_MASK] = { .type = NLA_U16 },
[TCA_TCINDEX_SHIFT] = { .type = NLA_U32 },
[TCA_TCINDEX_FALL_THROUGH] = { .type = NLA_U32 },
[TCA_TCINDEX_CLASSID] = { .type = NLA_U32 },
};
static int static int
tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle, tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
struct tcindex_data *p, struct tcindex_filter_result *r, struct tcindex_data *p, struct tcindex_filter_result *r,
...@@ -217,24 +225,14 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle, ...@@ -217,24 +225,14 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
else else
memset(&cr, 0, sizeof(cr)); memset(&cr, 0, sizeof(cr));
err = -EINVAL; if (tb[TCA_TCINDEX_HASH])
if (tb[TCA_TCINDEX_HASH]) {
if (nla_len(tb[TCA_TCINDEX_HASH]) < sizeof(u32))
goto errout;
cp.hash = nla_get_u32(tb[TCA_TCINDEX_HASH]); cp.hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
}
if (tb[TCA_TCINDEX_MASK]) { if (tb[TCA_TCINDEX_MASK])
if (nla_len(tb[TCA_TCINDEX_MASK]) < sizeof(u16))
goto errout;
cp.mask = nla_get_u16(tb[TCA_TCINDEX_MASK]); cp.mask = nla_get_u16(tb[TCA_TCINDEX_MASK]);
}
if (tb[TCA_TCINDEX_SHIFT]) { if (tb[TCA_TCINDEX_SHIFT])
if (nla_len(tb[TCA_TCINDEX_SHIFT]) < sizeof(int))
goto errout;
cp.shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]); cp.shift = nla_get_u32(tb[TCA_TCINDEX_SHIFT]);
}
err = -EBUSY; err = -EBUSY;
/* Hash already allocated, make sure that we still meet the /* Hash already allocated, make sure that we still meet the
...@@ -248,11 +246,8 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle, ...@@ -248,11 +246,8 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
goto errout; goto errout;
err = -EINVAL; err = -EINVAL;
if (tb[TCA_TCINDEX_FALL_THROUGH]) { if (tb[TCA_TCINDEX_FALL_THROUGH])
if (nla_len(tb[TCA_TCINDEX_FALL_THROUGH]) < sizeof(u32))
goto errout;
cp.fall_through = nla_get_u32(tb[TCA_TCINDEX_FALL_THROUGH]); cp.fall_through = nla_get_u32(tb[TCA_TCINDEX_FALL_THROUGH]);
}
if (!cp.hash) { if (!cp.hash) {
/* Hash not specified, use perfect hash if the upper limit /* Hash not specified, use perfect hash if the upper limit
...@@ -358,7 +353,7 @@ tcindex_change(struct tcf_proto *tp, unsigned long base, u32 handle, ...@@ -358,7 +353,7 @@ tcindex_change(struct tcf_proto *tp, unsigned long base, u32 handle,
if (!opt) if (!opt)
return 0; return 0;
err = nla_parse_nested(tb, TCA_TCINDEX_MAX, opt, NULL); err = nla_parse_nested(tb, TCA_TCINDEX_MAX, opt, tcindex_policy);
if (err < 0) if (err < 0)
return err; return err;
......
net/sched/cls_u32.c
View file @ 6fa8c014
...@@ -460,6 +460,16 @@ static u32 gen_new_kid(struct tc_u_hnode *ht, u32 handle) ...@@ -460,6 +460,16 @@ static u32 gen_new_kid(struct tc_u_hnode *ht, u32 handle)
return handle|(i>0xFFF ? 0xFFF : i); return handle|(i>0xFFF ? 0xFFF : i);
} }
static const struct nla_policy u32_policy[TCA_U32_MAX + 1] = {
[TCA_U32_CLASSID] = { .type = NLA_U32 },
[TCA_U32_HASH] = { .type = NLA_U32 },
[TCA_U32_LINK] = { .type = NLA_U32 },
[TCA_U32_DIVISOR] = { .type = NLA_U32 },
[TCA_U32_SEL] = { .len = sizeof(struct tc_u32_sel) },
[TCA_U32_INDEV] = { .type = NLA_STRING, .len = IFNAMSIZ },
[TCA_U32_MARK] = { .len = sizeof(struct tc_u32_mark) },
};
static int u32_set_parms(struct tcf_proto *tp, unsigned long base, static int u32_set_parms(struct tcf_proto *tp, unsigned long base,
struct tc_u_hnode *ht, struct tc_u_hnode *ht,
struct tc_u_knode *n, struct nlattr **tb, struct tc_u_knode *n, struct nlattr **tb,
...@@ -531,7 +541,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle, ...@@ -531,7 +541,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
if (opt == NULL) if (opt == NULL)
return handle ? -EINVAL : 0; return handle ? -EINVAL : 0;
err = nla_parse_nested(tb, TCA_U32_MAX, opt, NULL); err = nla_parse_nested(tb, TCA_U32_MAX, opt, u32_policy);
if (err < 0) if (err < 0)
return err; return err;
...@@ -593,8 +603,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle, ...@@ -593,8 +603,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
} else } else
handle = gen_new_kid(ht, htid); handle = gen_new_kid(ht, htid);
if (tb[TCA_U32_SEL] == NULL || if (tb[TCA_U32_SEL] == NULL)
nla_len(tb[TCA_U32_SEL]) < sizeof(struct tc_u32_sel))
return -EINVAL; return -EINVAL;
s = nla_data(tb[TCA_U32_SEL]); s = nla_data(tb[TCA_U32_SEL]);
...@@ -620,13 +629,6 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle, ...@@ -620,13 +629,6 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
if (tb[TCA_U32_MARK]) { if (tb[TCA_U32_MARK]) {
struct tc_u32_mark *mark; struct tc_u32_mark *mark;
if (nla_len(tb[TCA_U32_MARK]) < sizeof(struct tc_u32_mark)) {
#ifdef CONFIG_CLS_U32_PERF
kfree(n->pf);
#endif
kfree(n);
return -EINVAL;
}
mark = nla_data(tb[TCA_U32_MARK]); mark = nla_data(tb[TCA_U32_MARK]);
memcpy(&n->mark, mark, sizeof(struct tc_u32_mark)); memcpy(&n->mark, mark, sizeof(struct tc_u32_mark));
n->mark.success = 0; n->mark.success = 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7