summaryrefslogtreecommitdiff
path: root/net/sched/act_ife.c
diff options
context:
space:
mode:
authorYotam Gigi <yotam.gi@gmail.com>2016-09-26 13:45:26 +0300
committerDavid S. Miller <davem@davemloft.net>2016-09-27 16:53:17 +0300
commitc006da0be033b6ddcd27ee603d0ee01491236642 (patch)
treeeb6f82ecd60bbcea3c16a16809b2272b9147db59 /net/sched/act_ife.c
parent4b1d488a285a446329825d5fe91f987b7880e6e5 (diff)
downloadlinux-c006da0be033b6ddcd27ee603d0ee01491236642.tar.xz
act_ife: Fix false encoding
On ife encode side, the action stores the different tlvs inside the ife header, where each tlv length field should refer to the length of the whole tlv (without additional padding) and not just the data length. On ife decode side, the action iterates over the tlvs in the ife header and parses them one by one, where in each iteration the current pointer is advanced according to the tlv size. Before, the encoding encoded only the data length inside the tlv, which led to false parsing of ife the header. In addition, due to the fact that the loop counter was unsigned, it could lead to infinite parsing loop. This fix changes the loop counter to be signed and fixes the encoding to take into account the tlv type and size. Fixes: 28a10c426e81 ("net sched: fix encoding to use real length") Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Yotam Gigi <yotamg@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched/act_ife.c')
-rw-r--r--net/sched/act_ife.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 88ac9a8c9bbd..4a60cd5e1875 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -53,7 +53,7 @@ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval)
u32 *tlv = (u32 *)(skbdata);
u16 totlen = nla_total_size(dlen); /*alignment + hdr */
char *dptr = (char *)tlv + NLA_HDRLEN;
- u32 htlv = attrtype << 16 | dlen;
+ u32 htlv = attrtype << 16 | (dlen + NLA_HDRLEN);
*tlv = htonl(htlv);
memset(dptr, 0, totlen - NLA_HDRLEN);
@@ -627,7 +627,7 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
struct tcf_ife_info *ife = to_ife(a);
int action = ife->tcf_action;
struct ifeheadr *ifehdr = (struct ifeheadr *)skb->data;
- u16 ifehdrln = ifehdr->metalen;
+ int ifehdrln = (int)ifehdr->metalen;
struct meta_tlvhdr *tlv = (struct meta_tlvhdr *)(ifehdr->tlv_data);
spin_lock(&ife->tcf_lock);