From: Chris Wright Date: Thu, 6 Jul 2006 20:08:12 +0000 (-0700) Subject: Add pkt_sched fixes fwd from DaveM X-Git-Tag: v2.6.17.7~15^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4726f93b1e4b5b85de68867200cb70385aac29d7;p=thirdparty%2Fkernel%2Fstable-queue.git Add pkt_sched fixes fwd from DaveM --- diff --git a/queue-2.6.17/pkt_sched-fix-error-handling-while-dumping-actions.patch b/queue-2.6.17/pkt_sched-fix-error-handling-while-dumping-actions.patch new file mode 100644 index 00000000000..68ccd547110 --- /dev/null +++ b/queue-2.6.17/pkt_sched-fix-error-handling-while-dumping-actions.patch @@ -0,0 +1,44 @@ +From stable-bounces@linux.kernel.org Wed Jul 5 20:59:29 2006 +Date: Wed, 05 Jul 2006 20:58:51 -0700 (PDT) +From: David Miller +To: stable@kernel.org +Cc: +Subject: PKT_SCHED: Fix error handling while dumping actions + +From: Thomas Graf + +"return -err" and blindly inheriting the error code in the netlink +failure exception handler causes errors codes to be returned as +positive value therefore making them being ignored by the caller. + +May lead to sending out incomplete netlink messages. + +Signed-off-by: Thomas Graf +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +--- + net/sched/act_api.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- linux-2.6.17.3.orig/net/sched/act_api.c ++++ linux-2.6.17.3/net/sched/act_api.c +@@ -251,15 +251,17 @@ tcf_action_dump(struct sk_buff *skb, str + RTA_PUT(skb, a->order, 0, NULL); + err = tcf_action_dump_1(skb, a, bind, ref); + if (err < 0) +- goto rtattr_failure; ++ goto errout; + r->rta_len = skb->tail - (u8*)r; + } + + return 0; + + rtattr_failure: ++ err = -EINVAL; ++errout: + skb_trim(skb, b - skb->data); +- return -err; ++ return err; + } + + struct tc_action *tcf_action_init_1(struct rtattr *rta, struct rtattr *est, diff --git a/queue-2.6.17/pkt_sched-fix-illegal-memory-dereferences-when-dumping-actions.patch b/queue-2.6.17/pkt_sched-fix-illegal-memory-dereferences-when-dumping-actions.patch new file mode 100644 index 00000000000..0482b3581ca --- /dev/null +++ b/queue-2.6.17/pkt_sched-fix-illegal-memory-dereferences-when-dumping-actions.patch @@ -0,0 +1,75 @@ +From stable-bounces@linux.kernel.org Wed Jul 5 20:58:23 2006 +Date: Wed, 05 Jul 2006 20:58:02 -0700 (PDT) +From: David Miller +To: stable@kernel.org +Cc: +Subject: PKT_SCHED: Fix illegal memory dereferences when dumping actions + +From: Thomas Graf + +The TCA_ACT_KIND attribute is used without checking its +availability when dumping actions therefore leading to a +value of 0x4 being dereferenced. + +The use of strcmp() in tc_lookup_action_n() isn't safe +when fed with string from an attribute without enforcing +proper NUL termination. + +Both bugs can be triggered with malformed netlink message +and don't require any privileges. + +Signed-off-by: Thomas Graf +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +--- + net/sched/act_api.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- linux-2.6.17.3.orig/net/sched/act_api.c ++++ linux-2.6.17.3/net/sched/act_api.c +@@ -777,7 +777,7 @@ replay: + return ret; + } + +-static char * ++static struct rtattr * + find_dump_kind(struct nlmsghdr *n) + { + struct rtattr *tb1, *tb2[TCA_ACT_MAX+1]; +@@ -805,7 +805,7 @@ find_dump_kind(struct nlmsghdr *n) + return NULL; + kind = tb2[TCA_ACT_KIND-1]; + +- return (char *) RTA_DATA(kind); ++ return kind; + } + + static int +@@ -818,16 +818,15 @@ tc_dump_action(struct sk_buff *skb, stru + struct tc_action a; + int ret = 0; + struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh); +- char *kind = find_dump_kind(cb->nlh); ++ struct rtattr *kind = find_dump_kind(cb->nlh); + + if (kind == NULL) { + printk("tc_dump_action: action bad kind\n"); + return 0; + } + +- a_o = tc_lookup_action_n(kind); ++ a_o = tc_lookup_action(kind); + if (a_o == NULL) { +- printk("failed to find %s\n", kind); + return 0; + } + +@@ -835,7 +834,7 @@ tc_dump_action(struct sk_buff *skb, stru + a.ops = a_o; + + if (a_o->walk == NULL) { +- printk("tc_dump_action: %s !capable of dumping table\n", kind); ++ printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind); + goto rtattr_failure; + } + diff --git a/queue-2.6.17/pkt_sched-return-enoent-if-action-module-is-unavailable.patch b/queue-2.6.17/pkt_sched-return-enoent-if-action-module-is-unavailable.patch new file mode 100644 index 00000000000..bfa4b8ba5fd --- /dev/null +++ b/queue-2.6.17/pkt_sched-return-enoent-if-action-module-is-unavailable.patch @@ -0,0 +1,28 @@ +From stable-bounces@linux.kernel.org Wed Jul 5 20:59:23 2006 +Date: Wed, 05 Jul 2006 20:58:23 -0700 (PDT) +From: David Miller +To: stable@kernel.org +Cc: +Subject: PKT_SCHED: Return ENOENT if action module is unavailable + +From: Thomas Graf + +Return ENOENT if action module is unavailable + +Signed-off-by: Thomas Graf +Signed-off-by: David S. Miller +Signed-off-by: Chris Wright +--- + net/sched/act_api.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.17.3.orig/net/sched/act_api.c ++++ linux-2.6.17.3/net/sched/act_api.c +@@ -306,6 +306,7 @@ struct tc_action *tcf_action_init_1(stru + goto err_mod; + } + #endif ++ *err = -ENOENT; + goto err_out; + } + diff --git a/queue-2.6.17/series b/queue-2.6.17/series index 321f2a51c7a..9cd4b1acf3e 100644 --- a/queue-2.6.17/series +++ b/queue-2.6.17/series @@ -11,3 +11,6 @@ reduce-acpi-verbosity-on-null-handle-condition.patch via-velocity-the-link-is-not-correctly-detected-when-the-device-starts.patch 2-oopses-in-ethtool.patch kconfig-fix-description-and-dependencies-for-saa7115-module.patch +pkt_sched-fix-illegal-memory-dereferences-when-dumping-actions.patch +pkt_sched-return-enoent-if-action-module-is-unavailable.patch +pkt_sched-fix-error-handling-while-dumping-actions.patch