linux/net/sched
Etienne Noss 47c8dc47c0 act_connmark: avoid crashing on malformed nlattrs with null parms
[ Upstream commit 52491c7607 ]

tcf_connmark_init does not check in its configuration if TCA_CONNMARK_PARMS
is set, resulting in a null pointer dereference when trying to access it.

[501099.043007] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
[501099.043039] IP: [<ffffffffc10c60fb>] tcf_connmark_init+0x8b/0x180 [act_connmark]
...
[501099.044334] Call Trace:
[501099.044345]  [<ffffffffa47270e8>] ? tcf_action_init_1+0x198/0x1b0
[501099.044363]  [<ffffffffa47271b0>] ? tcf_action_init+0xb0/0x120
[501099.044380]  [<ffffffffa47250a4>] ? tcf_exts_validate+0xc4/0x110
[501099.044398]  [<ffffffffc0f5fa97>] ? u32_set_parms+0xa7/0x270 [cls_u32]
[501099.044417]  [<ffffffffc0f60bf0>] ? u32_change+0x680/0x87b [cls_u32]
[501099.044436]  [<ffffffffa4725d1d>] ? tc_ctl_tfilter+0x4dd/0x8a0
[501099.044454]  [<ffffffffa44a23a1>] ? security_capable+0x41/0x60
[501099.044471]  [<ffffffffa470ca01>] ? rtnetlink_rcv_msg+0xe1/0x220
[501099.044490]  [<ffffffffa470c920>] ? rtnl_newlink+0x870/0x870
[501099.044507]  [<ffffffffa472cc61>] ? netlink_rcv_skb+0xa1/0xc0
[501099.044524]  [<ffffffffa47073f4>] ? rtnetlink_rcv+0x24/0x30
[501099.044541]  [<ffffffffa472c634>] ? netlink_unicast+0x184/0x230
[501099.044558]  [<ffffffffa472c9d8>] ? netlink_sendmsg+0x2f8/0x3b0
[501099.044576]  [<ffffffffa46d8880>] ? sock_sendmsg+0x30/0x40
[501099.044592]  [<ffffffffa46d8e03>] ? SYSC_sendto+0xd3/0x150
[501099.044608]  [<ffffffffa425fda1>] ? __do_page_fault+0x2d1/0x510
[501099.044626]  [<ffffffffa47fbd7b>] ? system_call_fast_compare_end+0xc/0x9b

Fixes: 22a5dc0e5e ("net: sched: Introduce connmark action")
Signed-off-by: Étienne Noss <etienne.noss@wifirst.fr>
Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-03-22 12:43:34 +01:00
..
act_api.c net sched actions: decrement module reference count after table flush. 2017-03-22 12:43:32 +01:00
act_bpf.c bpf: use skb_at_tc_ingress helper in tcf_bpf 2016-09-15 19:29:47 -04:00
act_connmark.c act_connmark: avoid crashing on malformed nlattrs with null parms 2017-03-22 12:43:34 +01:00
act_csum.c net sched: stylistic cleanups 2016-09-19 22:04:14 -04:00
act_gact.c net sched: stylistic cleanups 2016-09-19 22:04:14 -04:00
act_ife.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-10-02 22:20:41 -04:00
act_ipt.c net_sched: move tc_action into tcf_common 2016-07-25 21:49:19 -07:00
act_meta_mark.c Support to encoding decoding skb mark on IFE action 2016-03-01 17:15:23 -05:00
act_meta_skbprio.c Support to encoding decoding skb prio on IFE action 2016-03-01 17:15:23 -05:00
act_meta_skbtcindex.c net sched ife action: Introduce skb tcindex metadata encap decap 2016-09-19 21:55:28 -04:00
act_mirred.c net/sched: act_mirred: Use passed lastuse argument 2016-10-20 11:14:24 -04:00
act_nat.c net_sched: move tc_action into tcf_common 2016-07-25 21:49:19 -07:00
act_pedit.c net/sched: pedit: make sure that offset is valid 2016-11-29 19:46:00 -05:00
act_police.c net sched: stylistic cleanups 2016-09-19 22:04:14 -04:00
act_simple.c net_sched: move tc_action into tcf_common 2016-07-25 21:49:19 -07:00
act_skbedit.c net_sched: move tc_action into tcf_common 2016-07-25 21:49:19 -07:00
act_skbmod.c net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump 2017-03-22 12:43:33 +01:00
act_tunnel_key.c net/sched: act_tunnel_key: Remove rcu_read_lock protection 2016-09-15 19:18:18 -04:00
act_vlan.c net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions 2016-10-03 21:40:50 -04:00
cls_api.c net, sched: fix soft lockup in tc_classify 2017-01-15 13:42:53 +01:00
cls_basic.c net, sched: respect rcu grace period on cls destruction 2016-11-28 10:47:35 -05:00
cls_bpf.c net, sched: respect rcu grace period on cls destruction 2016-11-28 10:47:35 -05:00
cls_cgroup.c net, sched: respect rcu grace period on cls destruction 2016-11-28 10:47:35 -05:00
cls_flow.c net, sched: respect rcu grace period on cls destruction 2016-11-28 10:47:35 -05:00
cls_flower.c net/sched: cls_flower: Fix missing addr_type in classify 2017-01-15 13:42:53 +01:00
cls_fw.c net sched: stylistic cleanups 2016-09-19 22:04:14 -04:00
cls_matchall.c net/sched: matchall: Fix configuration race 2017-02-18 15:11:41 +01:00
cls_route.c net_sched: check NULL on error path in route4_change() 2016-09-23 06:51:49 -04:00
cls_rsvp.c [NET_SCHED]: Remove unnecessary includes 2007-07-10 22:16:41 -07:00
cls_rsvp.h net, sched: respect rcu grace period on cls destruction 2016-11-28 10:47:35 -05:00
cls_rsvp6.c [NET_SCHED]: Remove unnecessary includes 2007-07-10 22:16:41 -07:00
cls_tcindex.c net, sched: respect rcu grace period on cls destruction 2016-11-28 10:47:35 -05:00
cls_u32.c net sched: stylistic cleanups 2016-09-19 22:04:14 -04:00
em_canid.c net: sched: remove tcf_proto from ematch calls 2014-10-06 18:02:32 -04:00
em_cmp.c net_sched: cleanups 2011-01-19 23:31:12 -08:00
em_ipset.c netfilter: x_tables: Pass struct net in xt_action_param 2015-09-18 21:58:14 +02:00
em_meta.c qdisc: constify meta_type_ops structures 2016-04-14 00:35:30 -04:00
em_nbyte.c net: sched: remove tcf_proto from ematch calls 2014-10-06 18:02:32 -04:00
em_text.c net: Remove state argument from skb_find_text() 2015-02-22 15:59:54 -05:00
em_u32.c net_sched: cleanups 2011-01-19 23:31:12 -08:00
ematch.c ematch: Fix auto-loading of ematch modules. 2015-02-20 15:30:56 -05:00
Kconfig net sched ife action: Introduce skb tcindex metadata encap decap 2016-09-19 21:55:28 -04:00
Makefile net sched ife action: Introduce skb tcindex metadata encap decap 2016-09-19 21:55:28 -04:00
sch_api.c net sched: stylistic cleanups 2016-09-19 22:04:14 -04:00
sch_atm.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_blackhole.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_cbq.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_choke.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_codel.c sched: replace __skb_dequeue with __qdisc_dequeue_head 2016-09-19 01:47:18 -04:00
sch_drr.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_dsmark.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_fifo.c sched: don't use skb queue helpers 2016-09-19 01:47:18 -04:00
sch_fq.c net_sched: sch_fq: account for schedule/timers drifts 2016-09-23 07:19:06 -04:00
sch_fq_codel.c net_sched: fq_codel: cache skb->truesize into skb->cb 2016-06-25 12:19:35 -04:00
sch_generic.c sched: add and use qdisc_skb_head helpers 2016-09-19 01:47:18 -04:00
sch_gred.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_hfsc.c net/sched/sch_hfsc.c: remove unused cl_myfadj 2016-08-08 16:06:47 -07:00
sch_hhf.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_htb.c sched: add and use qdisc_skb_head helpers 2016-09-19 01:47:18 -04:00
sch_ingress.c net: sched: fix tc_should_offload for specific clsact classes 2016-06-07 16:59:53 -07:00
sch_mq.c net: sched: convert qdisc linked list to hashtable 2016-08-10 17:19:02 -07:00
sch_mqprio.c net: sched: convert qdisc linked list to hashtable 2016-08-10 17:19:02 -07:00
sch_multiq.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_netem.c sched: add and use qdisc_skb_head helpers 2016-09-19 01:47:18 -04:00
sch_pie.c sched: replace __skb_dequeue with __qdisc_dequeue_head 2016-09-19 01:47:18 -04:00
sch_plug.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_prio.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2016-06-30 05:03:36 -04:00
sch_qfq.c sch_qfq: keep backlog updated with qlen 2016-09-23 06:52:31 -04:00
sch_red.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_sfb.c sch_sfb: keep backlog updated with qlen 2016-09-23 06:52:31 -04:00
sch_sfq.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_tbf.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00
sch_teql.c net_sched: drop packets after root qdisc lock is released 2016-06-25 12:19:35 -04:00