PKT_SCHED: Fix illegal memory dereferences when dumping actions

The TCA_ACT_KIND attribute is used without checking its
availability when dumping actions therefore leading to a
value of 0x4 being dereferenced.

The use of strcmp() in tc_lookup_action_n() isn't safe
when fed with string from an attribute without enforcing
proper NUL termination.

Both bugs can be triggered with malformed netlink message
and don't require any privileges.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 2ffa11c6e8ded50080855fe7250642ebacc8cf2f..2c2c37191ffd927298d7bf78e4c986f8ccaa548b 100644 (file)
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -777,7 +777,7 @@ replay:
        return ret;
 }
 
-static char *
+static struct rtattr *
 find_dump_kind(struct nlmsghdr *n)
 {
        struct rtattr *tb1, *tb2[TCA_ACT_MAX+1];
@@ -805,7 +805,7 @@ find_dump_kind(struct nlmsghdr *n)
                return NULL;
        kind = tb2[TCA_ACT_KIND-1];
 
-       return (char *) RTA_DATA(kind);
+       return kind;
 }
 
 static int
@@ -818,16 +818,15 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
        struct tc_action a;
        int ret = 0;
        struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
-       char *kind = find_dump_kind(cb->nlh);
+       struct rtattr *kind = find_dump_kind(cb->nlh);
 
        if (kind == NULL) {
                printk("tc_dump_action: action bad kind\n");
                return 0;
        }
 
-       a_o = tc_lookup_action_n(kind);
+       a_o = tc_lookup_action(kind);
        if (a_o == NULL) {
-               printk("failed to find %s\n", kind);
                return 0;
        }
 
@@ -835,7 +834,7 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
        a.ops = a_o;
 
        if (a_o->walk == NULL) {
-               printk("tc_dump_action: %s !capable of dumping table\n", kind);
+               printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind);
                goto rtattr_failure;
        }