netdev - Re: [PATCH net] net/sched: cls_api: add missing validation of netlink attributes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 09 Oct 2018 18:12:58 +0200
From:   Davide Caratti <dcaratti@...hat.com>
To:     David Ahern <dsahern@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jamal Hadi Salim <jhs@...atatu.com>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net] net/sched: cls_api: add missing validation of
 netlink attributes

On Tue, 2018-10-09 at 08:46 -0600, David Ahern wrote:
> On 10/9/18 7:10 AM, Davide Caratti wrote:
> > Similarly to what has been done in 8b4c3cdd9dd8 ("net: sched: Add policy
> > validation for tc attributes"), add validation for TCA_CHAIN and TCA_KIND
> > netlink attributes.
> > 
> > tested with:
> >  # ./tdc.py -c filter
> > 
> > Fixes: 5bc1701881e39 ("net: sched: introduce multichain support for filters")
> > Signed-off-by: Davide Caratti <dcaratti@...hat.com>
> > ---
> >  net/sched/cls_api.c | 16 +++++++++++-----
> >  1 file changed, 11 insertions(+), 5 deletions(-)
> > 
> > diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
> > index 0a75cb2e5e7b..fb1afc0e130d 100644

hi David,
thanks for looking at this.

> > --- a/net/sched/cls_api.c
> > +++ b/net/sched/cls_api.c
> > @@ -37,6 +37,11 @@ static LIST_HEAD(tcf_proto_base);
> >  /* Protects list of registered TC modules. It is pure SMP lock. */
> >  static DEFINE_RWLOCK(cls_mod_lock);
> >  
> > +const struct nla_policy cls_tca_policy[TCA_MAX + 1] = {
> > +	[TCA_KIND]	= { .type = NLA_STRING },
> > +	[TCA_CHAIN]	= { .type = NLA_U32 },
> > +};
> > +
> 

> it be nice to have a tc_common module so this stuff does not have to be
> defined multiple times.

it makes sense to avoid duplicating the declaration of that array. But I
don't think we can put it in a module, because CONFIG_NET_SCHED is 'bool'
and

obj-$(CONFIG_NET_SCHED)         += sch_api.o

I can try a v2 where 'rtm_tca_policy' symbol in sch_api is exported and
used by cls_api.c code. WDYT?

thanks,
-- 
davide