netdev - [iproute2] tc/pedit: Fix wrong pedit ipv6 structure id

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20190227121017.4244-1-dmitrolin@mellanox.com>
Date:   Wed, 27 Feb 2019 12:10:17 +0000
From:   Dmytro Linkin <dmitrolin@...lanox.com>
To:     netdev@...r.kernel.org
Cc:     Dmytro Linkin <dmitrolin@...lanox.com>
Subject: [iproute2] tc/pedit: Fix wrong pedit ipv6 structure id

Tc pedit action with more than two ip6 munge in a row cause infinite
loop.

Example:

$ tc filter add dev eth0 protocol ipv6 parent ffff: \
flower ip_proto sctp \
    action pedit ex \
        munge ip6 hoplimit set 0x1 \
        munge ip6 src set 2001:0db8:0:f101::1 \
        munge that cause infinite loop

The example command never returns, instead of failing with parse error
as expected. Pedit ipv6 structure has wrong id, which leads to the
creation linked list with one node in tc/m_pedit.c:get_pedit_kind(),
referring to itself. This node is created if command have two ip6 munge
in a row, and any third ip6 munge will cause infinite loop.
Changing this id from "ipv6" to "ip6" solves the problem.

Fixes: f3e1b2448a95 ("pedit: Introduce ipv6 support")
Signed-off-by: Dmytro Linkin <dmitrolin@...lanox.com>
Reviewed-by: Roi Dayan <roid@...lanox.com>
---
 tc/p_ip6.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tc/p_ip6.c b/tc/p_ip6.c
index dbfdca42..7cc7997b 100644
--- a/tc/p_ip6.c
+++ b/tc/p_ip6.c
@@ -84,6 +84,6 @@ done:
 }

 struct m_pedit_util p_pedit_ip6 = {
-	.id = "ipv6",
+	.id = "ip6",
 	.parse_peopt = parse_ip6,
 };
-- 
2.13.6