Etienne Noss 52491c7607 act_connmark: avoid crashing on malformed nlattrs with null parms ...

tcf_connmark_init does not check in its configuration if TCA_CONNMARK_PARMS
is set, resulting in a null pointer dereference when trying to access it.

[501099.043007] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
[501099.043039] IP: [<ffffffffc10c60fb>] tcf_connmark_init+0x8b/0x180 [act_connmark]
...
[501099.044334] Call Trace:
[501099.044345]  [<ffffffffa47270e8>] ? tcf_action_init_1+0x198/0x1b0
[501099.044363]  [<ffffffffa47271b0>] ? tcf_action_init+0xb0/0x120
[501099.044380]  [<ffffffffa47250a4>] ? tcf_exts_validate+0xc4/0x110
[501099.044398]  [<ffffffffc0f5fa97>] ? u32_set_parms+0xa7/0x270 [cls_u32]
[501099.044417]  [<ffffffffc0f60bf0>] ? u32_change+0x680/0x87b [cls_u32]
[501099.044436]  [<ffffffffa4725d1d>] ? tc_ctl_tfilter+0x4dd/0x8a0
[501099.044454]  [<ffffffffa44a23a1>] ? security_capable+0x41/0x60
[501099.044471]  [<ffffffffa470ca01>] ? rtnetlink_rcv_msg+0xe1/0x220
[501099.044490]  [<ffffffffa470c920>] ? rtnl_newlink+0x870/0x870
[501099.044507]  [<ffffffffa472cc61>] ? netlink_rcv_skb+0xa1/0xc0
[501099.044524]  [<ffffffffa47073f4>] ? rtnetlink_rcv+0x24/0x30
[501099.044541]  [<ffffffffa472c634>] ? netlink_unicast+0x184/0x230
[501099.044558]  [<ffffffffa472c9d8>] ? netlink_sendmsg+0x2f8/0x3b0
[501099.044576]  [<ffffffffa46d8880>] ? sock_sendmsg+0x30/0x40
[501099.044592]  [<ffffffffa46d8e03>] ? SYSC_sendto+0xd3/0x150
[501099.044608]  [<ffffffffa425fda1>] ? __do_page_fault+0x2d1/0x510
[501099.044626]  [<ffffffffa47fbd7b>] ? system_call_fast_compare_end+0xc/0x9b

Fixes: 22a5dc0e5e3e ("net: sched: Introduce connmark action")
Signed-off-by: Étienne Noss <etienne.noss@wifirst.fr>
Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-03-12 23:32:41 -07:00

..

act_api.c

net sched actions: do not overwrite status of action creation.

2017-02-26 21:31:32 -05:00

act_bpf.c

bpf: rework prog_digest into prog_tag

2017-01-16 14:03:31 -05:00

act_connmark.c

act_connmark: avoid crashing on malformed nlattrs with null parms

2017-03-12 23:32:41 -07:00

act_csum.c

net/sched: act_csum: compute crc32c on SCTP packets

2017-01-09 14:36:57 -05:00

act_gact.c

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

act_ife.c

net/sched: act_ife: Change to use ife module

2017-02-03 15:16:46 -05:00

act_ipt.c

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

act_meta_mark.c

Support to encoding decoding skb mark on IFE action

2016-03-01 17:15:23 -05:00

act_meta_skbprio.c

Support to encoding decoding skb prio on IFE action

2016-03-01 17:15:23 -05:00

act_meta_skbtcindex.c

net sched ife action: Introduce skb tcindex metadata encap decap

2016-09-19 21:55:28 -04:00

act_mirred.c

net/sched: act_mirred: remove duplicated include from act_mirred.c

2017-02-07 11:42:34 -05:00

act_nat.c

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

act_pedit.c

net/act_pedit: Introduce 'add' operation

2017-02-10 13:18:33 -05:00

act_police.c

net_sched: gen_estimator: complete rewrite of rate estimators

2016-12-05 15:21:59 -05:00

act_sample.c

net/sched: act_psample: Remove unnecessary ASSERT_RTNL

2017-02-01 14:10:03 -05:00

act_simple.c

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

act_skbedit.c

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

act_skbmod.c

net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump

2017-03-07 14:13:03 -08:00

act_tunnel_key.c

net/sched: act_tunnel_key: Fix setting UDP dst port in metadata under IPv6

2016-12-23 11:59:56 -05:00

act_vlan.c

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

cls_api.c

sched: Fix accidental removal of errout goto

2017-02-14 11:44:14 -05:00

cls_basic.c

net, sched: respect rcu grace period on cls destruction

2016-11-28 10:47:35 -05:00

cls_bpf.c

net/sched: cls_bpf: Reflect HW offload status

2017-02-17 12:08:06 -05:00

cls_cgroup.c

net, sched: respect rcu grace period on cls destruction

2016-11-28 10:47:35 -05:00

cls_flow.c

skbuff: add and use skb_nfct helper

2017-02-02 14:31:53 +01:00

cls_flower.c

net/sched: cls_flower: Reflect HW offload status

2017-02-17 12:08:05 -05:00

cls_fw.c

net sched: stylistic cleanups

2016-09-19 22:04:14 -04:00

cls_matchall.c

net/sched: cls_matchall: Reflect HW offloading status

2017-02-17 12:08:06 -05:00

cls_route.c

net_sched: check NULL on error path in route4_change()

2016-09-23 06:51:49 -04:00

cls_rsvp6.c

…

cls_rsvp.c

…

cls_rsvp.h

net, sched: respect rcu grace period on cls destruction

2016-11-28 10:47:35 -05:00

cls_tcindex.c

net, sched: respect rcu grace period on cls destruction

2016-11-28 10:47:35 -05:00

cls_u32.c

net/sched: cls_u32: Reflect HW offload status

2017-02-17 12:08:06 -05:00

em_canid.c

net: sched: remove tcf_proto from ematch calls

2014-10-06 18:02:32 -04:00

em_cmp.c

net_sched: cleanups

2011-01-19 23:31:12 -08:00

em_ipset.c

netfilter: x_tables: move hook state into xt_action_param structure

2016-11-03 10:56:21 +01:00

em_meta.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/loadavg.h>

2017-03-02 08:42:27 +01:00

em_nbyte.c

net: sched: remove tcf_proto from ematch calls

2014-10-06 18:02:32 -04:00

em_text.c

net: Remove state argument from skb_find_text()

2015-02-22 15:59:54 -05:00

em_u32.c

net_sched: cleanups

2011-01-19 23:31:12 -08:00

ematch.c

ematch: Fix auto-loading of ematch modules.

2015-02-20 15:30:56 -05:00

Kconfig

net/sched: act_ife: Change to use ife module

2017-02-03 15:16:46 -05:00

Makefile

net/sched: Introduce sample tc action

2017-01-24 13:44:28 -05:00

sch_api.c

pkt_sched: Remove useless qdisc_stab_lock

2017-02-17 15:10:18 -05:00

sch_atm.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_blackhole.c

net_sched: drop packets after root qdisc lock is released

2016-06-25 12:19:35 -04:00

sch_cbq.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_choke.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_codel.c

sched: replace __skb_dequeue with __qdisc_dequeue_head

2016-09-19 01:47:18 -04:00

sch_drr.c

net_sched: gen_estimator: complete rewrite of rate estimators

2016-12-05 15:21:59 -05:00

sch_dsmark.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_fifo.c

sched: don't use skb queue helpers

2016-09-19 01:47:18 -04:00

sch_fq_codel.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_fq.c

net_sched: sch_fq: use rb_entry()

2016-12-20 14:22:48 -05:00

sch_generic.c

net: dev_weight: TX/RX orthogonality

2016-12-29 15:38:35 -05:00

sch_gred.c

net_sched: drop packets after root qdisc lock is released

2016-06-25 12:19:35 -04:00

sch_hfsc.c

net_sched: gen_estimator: complete rewrite of rate estimators

2016-12-05 15:21:59 -05:00

sch_hhf.c

net_sched: fix error recovery at qdisc creation

2017-02-11 21:38:58 -05:00

sch_htb.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_ingress.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_mq.c

net_sched: fix error recovery at qdisc creation

2017-02-11 21:38:58 -05:00

sch_mqprio.c

net_sched: fix error recovery at qdisc creation

2017-02-11 21:38:58 -05:00

sch_multiq.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_netem.c

net-tc: convert tc_from to tc_from_ingress and tc_redirected

2017-01-08 20:58:52 -05:00

sch_pie.c

sched: replace __skb_dequeue with __qdisc_dequeue_head

2016-09-19 01:47:18 -04:00

sch_plug.c

net_sched: drop packets after root qdisc lock is released

2016-06-25 12:19:35 -04:00

sch_prio.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_qfq.c

net_sched: gen_estimator: complete rewrite of rate estimators

2016-12-05 15:21:59 -05:00

sch_red.c

net_sched: drop packets after root qdisc lock is released

2016-06-25 12:19:35 -04:00

sch_sfb.c

sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api

2017-02-10 11:38:08 -05:00

sch_sfq.c

net_sched: fix error recovery at qdisc creation

2017-02-11 21:38:58 -05:00

sch_tbf.c

net_sched: drop packets after root qdisc lock is released

2016-06-25 12:19:35 -04:00

sch_teql.c

net: make ndo_get_stats64 a void function

2017-01-08 17:51:44 -05:00