Etienne Noss 52491c7607 act_connmark: avoid crashing on malformed nlattrs with null parms ... tcf_connmark_init does not check in its configuration if TCA_CONNMARK_PARMS is set, resulting in a null pointer dereference when trying to access it. [501099.043007] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 [501099.043039] IP: [<ffffffffc10c60fb>] tcf_connmark_init+0x8b/0x180 [act_connmark] ... [501099.044334] Call Trace: [501099.044345] [<ffffffffa47270e8>] ? tcf_action_init_1+0x198/0x1b0 [501099.044363] [<ffffffffa47271b0>] ? tcf_action_init+0xb0/0x120 [501099.044380] [<ffffffffa47250a4>] ? tcf_exts_validate+0xc4/0x110 [501099.044398] [<ffffffffc0f5fa97>] ? u32_set_parms+0xa7/0x270 [cls_u32] [501099.044417] [<ffffffffc0f60bf0>] ? u32_change+0x680/0x87b [cls_u32] [501099.044436] [<ffffffffa4725d1d>] ? tc_ctl_tfilter+0x4dd/0x8a0 [501099.044454] [<ffffffffa44a23a1>] ? security_capable+0x41/0x60 [501099.044471] [<ffffffffa470ca01>] ? rtnetlink_rcv_msg+0xe1/0x220 [501099.044490] [<ffffffffa470c920>] ? rtnl_newlink+0x870/0x870 [501099.044507] [<ffffffffa472cc61>] ? netlink_rcv_skb+0xa1/0xc0 [501099.044524] [<ffffffffa47073f4>] ? rtnetlink_rcv+0x24/0x30 [501099.044541] [<ffffffffa472c634>] ? netlink_unicast+0x184/0x230 [501099.044558] [<ffffffffa472c9d8>] ? netlink_sendmsg+0x2f8/0x3b0 [501099.044576] [<ffffffffa46d8880>] ? sock_sendmsg+0x30/0x40 [501099.044592] [<ffffffffa46d8e03>] ? SYSC_sendto+0xd3/0x150 [501099.044608] [<ffffffffa425fda1>] ? __do_page_fault+0x2d1/0x510 [501099.044626] [<ffffffffa47fbd7b>] ? system_call_fast_compare_end+0xc/0x9b Fixes: 22a5dc0e5e ("net: sched: Introduce connmark action") Signed-off-by: Étienne Noss <etienne.noss@wifirst.fr> Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-03-12 23:32:41 -07:00
..
act_api.c	net sched actions: do not overwrite status of action creation.	2017-02-26 21:31:32 -05:00
act_bpf.c
act_connmark.c	act_connmark: avoid crashing on malformed nlattrs with null parms	2017-03-12 23:32:41 -07:00
act_csum.c
act_gact.c
act_ife.c	net/sched: act_ife: Change to use ife module	2017-02-03 15:16:46 -05:00
act_ipt.c
act_meta_mark.c
act_meta_skbprio.c
act_meta_skbtcindex.c
act_mirred.c	net/sched: act_mirred: remove duplicated include from act_mirred.c	2017-02-07 11:42:34 -05:00
act_nat.c
act_pedit.c	net/act_pedit: Introduce 'add' operation	2017-02-10 13:18:33 -05:00
act_police.c
act_sample.c
act_simple.c
act_skbedit.c
act_skbmod.c	net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump	2017-03-07 14:13:03 -08:00
act_tunnel_key.c
act_vlan.c
cls_api.c	sched: Fix accidental removal of errout goto	2017-02-14 11:44:14 -05:00
cls_basic.c
cls_bpf.c	net/sched: cls_bpf: Reflect HW offload status	2017-02-17 12:08:06 -05:00
cls_cgroup.c
cls_flow.c
cls_flower.c	net/sched: cls_flower: Reflect HW offload status	2017-02-17 12:08:05 -05:00
cls_fw.c
cls_matchall.c	net/sched: cls_matchall: Reflect HW offloading status	2017-02-17 12:08:06 -05:00
cls_route.c
cls_rsvp6.c
cls_rsvp.c
cls_rsvp.h
cls_tcindex.c
cls_u32.c	net/sched: cls_u32: Reflect HW offload status	2017-02-17 12:08:06 -05:00
em_canid.c
em_cmp.c
em_ipset.c
em_meta.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/loadavg.h>	2017-03-02 08:42:27 +01:00
em_nbyte.c
em_text.c
em_u32.c
ematch.c
Kconfig	net/sched: act_ife: Change to use ife module	2017-02-03 15:16:46 -05:00
Makefile
sch_api.c	pkt_sched: Remove useless qdisc_stab_lock	2017-02-17 15:10:18 -05:00
sch_atm.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_blackhole.c
sch_cbq.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_choke.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_codel.c
sch_drr.c
sch_dsmark.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_fifo.c
sch_fq_codel.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_fq.c
sch_generic.c
sch_gred.c
sch_hfsc.c
sch_hhf.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_htb.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_ingress.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_mq.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_mqprio.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_multiq.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_netem.c
sch_pie.c
sch_plug.c
sch_prio.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_qfq.c
sch_red.c
sch_sfb.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_sfq.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_tbf.c
sch_teql.c