diff options
author | Alex Shi <alex.shi@linaro.org> | 2016-12-12 22:16:26 +0800 |
---|---|---|
committer | Alex Shi <alex.shi@linaro.org> | 2016-12-12 22:16:26 +0800 |
commit | a057484ab40ff81f22a94bb62c035c78b5abd940 (patch) | |
tree | 770ed007ccc70bee7e533a7fe532dd8a774b1457 /net/sched/act_pedit.c | |
parent | 3ba1692e7239293d7bc5a596ca9b0707f5bc07d5 (diff) | |
parent | c95b7f1fab0c76882764a5196119237c8ad436ee (diff) |
Merge remote-tracking branch 'lts/linux-4.4.y' into linux-linaro-lsk-v4.4lsk-v4.4-16.12
Conflicts:
also change cpu_enable_uao in arch/arm64/include/asm/processor.h
comment unmatch fixed in arch/arm64/kernel/suspend.c
Diffstat (limited to 'net/sched/act_pedit.c')
-rw-r--r-- | net/sched/act_pedit.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c index e38a7701f154..c3434e902445 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c @@ -104,6 +104,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind) kfree(keys); } +static bool offset_valid(struct sk_buff *skb, int offset) +{ + if (offset > 0 && offset > skb->len) + return false; + + if (offset < 0 && -offset > skb_headroom(skb)) + return false; + + return true; +} + static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, struct tcf_result *res) { @@ -130,6 +141,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, if (tkey->offmask) { char *d, _d; + if (!offset_valid(skb, off + tkey->at)) { + pr_info("tc filter pedit 'at' offset %d out of bounds\n", + off + tkey->at); + goto bad; + } d = skb_header_pointer(skb, off + tkey->at, 1, &_d); if (!d) @@ -142,10 +158,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a, " offset must be on 32 bit boundaries\n"); goto bad; } - if (offset > 0 && offset > skb->len) { - pr_info("tc filter pedit" - " offset %d can't exceed pkt length %d\n", - offset, skb->len); + + if (!offset_valid(skb, off + offset)) { + pr_info("tc filter pedit offset %d out of bounds\n", + offset); goto bad; } |