Skip to contentSkip to conversation

cls_rsvp: add sanity check for the packet length

PATCH In review Changli Gao 2 participants 4 messages Aug 4, 2010

Subsystems (3)
Networking Network drivers Traffic control (tc)
lore
Share & tools
lore

Changli Gao

author
#0 lore raw

PATCH 1/1 cls_rsvp: add sanity check for the packet length

The packet length should be checked before the packet data is dereferenced.

Signed-off-by Changli Gao <[email protected]>
---
 net/sched/cls_rsvp.h |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
net/sched/cls_rsvp.h +9 -1
index dd9414e..4fa119d 100644
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
 	u8 tunnelid = 0;
 	u8 *xprt;
 #if RSVP_DST_LEN == 4
-	struct ipv6hdr *nhptr = ipv6_hdr(skb);
+	struct ipv6hdr *nhptr;
+
+	if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+		return -1;
+	nhptr = ipv6_hdr(skb);
 #else
 	struct iphdr *nhptr = ip_hdr(skb);
+
+	if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+		return -1;
+	nhptr = ip_hdr(skb);
 #endif
 
 restart:
Acked-by on v1 1/1
#1 lore raw
Quoted 17 lines · Changli Gao

The packet length should be checked before the packet data is dereferenced.

Signed-off-by Changli Gao <[email protected]>
---
 net/sched/cls_rsvp.h |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
net/sched/cls_rsvp.h +2 -1
index dd9414e..4fa119d 100644
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
 	u8 tunnelid = 0;
 	u8 *xprt;
 #if RSVP_DST_LEN == 4
-	struct ipv6hdr *nhptr = ipv6_hdr(skb);
+	struct ipv6hdr *nhptr;
+

net/sched/cls_rsvp.h static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp, · line 157

Quoted 10 lines
net/sched/cls_rsvp.h +7 -0
+	if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+		return -1;
+	nhptr = ipv6_hdr(skb);
 #else
 	struct iphdr *nhptr = ip_hdr(skb);
+
+	if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+		return -1;
+	nhptr = ip_hdr(skb);
 #endif

Maybe a good time to move nhptr declaration outside #if since it is used in #else as well.

Otherwise:

Acked-by Jamal Hadi Salim <[email protected]>

cheers,
jamal

author
#2 lore raw
Quoted 23 lines · jamal
Quoted 22 lines · Changli Gao

The packet length should be checked before the packet data is dereferenced.

Signed-off-by Changli Gao <[email protected]>

---
 net/sched/cls_rsvp.h |   10 +++++++++-

 1 file changed, 9 insertions(+), 1 deletion(-)
net/sched/cls_rsvp.h +5 -1
index dd9414e..4fa119d 100644
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
       u8 tunnelid = 0;
       u8 *xprt;
  #if RSVP_DST_LEN == 4
-     struct ipv6hdr *nhptr = ipv6_hdr(skb);
+     struct ipv6hdr *nhptr;
+
+     if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+             return -1;
+     nhptr = ipv6_hdr(skb);
  #else
       struct iphdr *nhptr = ip_hdr(skb);
Quoted 9 lines

net/sched/cls_rsvp.h static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp, · line 157

Quoted 5 lines
net/sched/cls_rsvp.h +4 -0
+
+     if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+             return -1;
+     nhptr = ip_hdr(skb);
  #endif

Maybe a good time to move nhptr declaration outside #if since it is used in #else as well.

They are not the same type. I am afraid that it won't work.

Signature · 2 lines
Regards,
Changli Gao([email protected])
author
#3 lore raw
Quoted 34 lines · Changli Gao
Quoted 23 lines · jamal
Quoted 22 lines · Changli Gao

The packet length should be checked before the packet data is dereferenced.

Signed-off-by Changli Gao <[email protected]>

---
 net/sched/cls_rsvp.h |   10 +++++++++-

 1 file changed, 9 insertions(+), 1 deletion(-)
net/sched/cls_rsvp.h +5 -1
index dd9414e..4fa119d 100644
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
       u8 tunnelid = 0;
       u8 *xprt;
  #if RSVP_DST_LEN == 4
-     struct ipv6hdr *nhptr = ipv6_hdr(skb);
+     struct ipv6hdr *nhptr;
+
+     if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+             return -1;
+     nhptr = ipv6_hdr(skb);
  #else
       struct iphdr *nhptr = ip_hdr(skb);
Quoted 9 lines

net/sched/cls_rsvp.h static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp, · line 157

Quoted 5 lines
net/sched/cls_rsvp.h +4 -0
+
+     if (!pskb_may_pull(skb, skb_network_offset(skb) + sizeof(*nhptr)))
+             return -1;
+     nhptr = ip_hdr(skb);
  #endif

Maybe a good time to move nhptr declaration outside #if since it is used in #else as well.

Quoted 2 lines

They are not the same type. I am afraid that it won't work.

I'll respin it with the routine pskb_network_may_pull(). Thanks.

Signature · 2 lines
Regards,
Changli Gao([email protected])