Wolfgang Bumiller e0535ce58b net sched actions: allocate act cookie early ... Policing filters do not use the TCA_ACT_* enum and the tb[] nlattr array in tcf_action_init_1() doesn't get filled for them so we should not try to look for a TCA_ACT_COOKIE attribute in the then uninitialized array. The error handling in cookie allocation then calls tcf_hash_release() leading to invalid memory access later on. Additionally, if cookie allocation fails after an already existing non-policing filter has successfully been changed, tcf_action_release() should not be called, also we would have to roll back the changes in the error handling, so instead we now allocate the cookie early and assign it on success at the end. CVE-2017-7979 Fixes: 1045ba77a5 ("net sched actions: Add support for user cookies") Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-04-20 16:32:07 -04:00
..
Kconfig	net/sched: act_ife: Change to use ife module	2017-02-03 15:16:46 -05:00
Makefile	net/sched: Introduce sample tc action	2017-01-24 13:44:28 -05:00
act_api.c	net sched actions: allocate act cookie early	2017-04-20 16:32:07 -04:00
act_bpf.c	bpf: rework prog_digest into prog_tag	2017-01-16 14:03:31 -05:00
act_connmark.c	act_connmark: avoid crashing on malformed nlattrs with null parms	2017-03-12 23:32:41 -07:00
act_csum.c	net/sched: act_csum: compute crc32c on SCTP packets	2017-01-09 14:36:57 -05:00
act_gact.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
act_ife.c	net/sched: act_ife: Change to use ife module	2017-02-03 15:16:46 -05:00
act_ipt.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
act_meta_mark.c	Support to encoding decoding skb mark on IFE action	2016-03-01 17:15:23 -05:00
act_meta_skbprio.c	Support to encoding decoding skb prio on IFE action	2016-03-01 17:15:23 -05:00
act_meta_skbtcindex.c	net sched ife action: Introduce skb tcindex metadata encap decap	2016-09-19 21:55:28 -04:00
act_mirred.c	net/sched: act_mirred: remove duplicated include from act_mirred.c	2017-02-07 11:42:34 -05:00
act_nat.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
act_pedit.c	net/act_pedit: Introduce 'add' operation	2017-02-10 13:18:33 -05:00
act_police.c	net_sched: gen_estimator: complete rewrite of rate estimators	2016-12-05 15:21:59 -05:00
act_sample.c	net/sched: act_psample: Remove unnecessary ASSERT_RTNL	2017-02-01 14:10:03 -05:00
act_simple.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
act_skbedit.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
act_skbmod.c	net/sched: act_skbmod: remove unneeded rcu_read_unlock in tcf_skbmod_dump	2017-03-07 14:13:03 -08:00
act_tunnel_key.c	net/sched: act_tunnel_key: Fix setting UDP dst port in metadata under IPv6	2016-12-23 11:59:56 -05:00
act_vlan.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
cls_api.c	sched: Fix accidental removal of errout goto	2017-02-14 11:44:14 -05:00
cls_basic.c	net, sched: respect rcu grace period on cls destruction	2016-11-28 10:47:35 -05:00
cls_bpf.c	net/sched: cls_bpf: Reflect HW offload status	2017-02-17 12:08:06 -05:00
cls_cgroup.c	net, sched: respect rcu grace period on cls destruction	2016-11-28 10:47:35 -05:00
cls_flow.c	skbuff: add and use skb_nfct helper	2017-02-02 14:31:53 +01:00
cls_flower.c	net/sched: cls_flower: Reflect HW offload status	2017-02-17 12:08:05 -05:00
cls_fw.c	net sched: stylistic cleanups	2016-09-19 22:04:14 -04:00
cls_matchall.c	net/sched: cls_matchall: Reflect HW offloading status	2017-02-17 12:08:06 -05:00
cls_route.c	net_sched: check NULL on error path in route4_change()	2016-09-23 06:51:49 -04:00
cls_rsvp.c	[NET_SCHED]: Remove unnecessary includes	2007-07-10 22:16:41 -07:00
cls_rsvp.h	net, sched: respect rcu grace period on cls destruction	2016-11-28 10:47:35 -05:00
cls_rsvp6.c	[NET_SCHED]: Remove unnecessary includes	2007-07-10 22:16:41 -07:00
cls_tcindex.c	net, sched: respect rcu grace period on cls destruction	2016-11-28 10:47:35 -05:00
cls_u32.c	net/sched: cls_u32: Reflect HW offload status	2017-02-17 12:08:06 -05:00
em_canid.c	net: sched: remove tcf_proto from ematch calls	2014-10-06 18:02:32 -04:00
em_cmp.c	net_sched: cleanups	2011-01-19 23:31:12 -08:00
em_ipset.c	netfilter: x_tables: move hook state into xt_action_param structure	2016-11-03 10:56:21 +01:00
em_meta.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/loadavg.h>	2017-03-02 08:42:27 +01:00
em_nbyte.c	net: sched: remove tcf_proto from ematch calls	2014-10-06 18:02:32 -04:00
em_text.c	net: Remove state argument from skb_find_text()	2015-02-22 15:59:54 -05:00
em_u32.c	net_sched: cleanups	2011-01-19 23:31:12 -08:00
ematch.c	ematch: Fix auto-loading of ematch modules.	2015-02-20 15:30:56 -05:00
sch_api.c	pkt_sched: Remove useless qdisc_stab_lock	2017-02-17 15:10:18 -05:00
sch_atm.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_blackhole.c	net_sched: drop packets after root qdisc lock is released	2016-06-25 12:19:35 -04:00
sch_cbq.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_choke.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_codel.c	sched: replace __skb_dequeue with __qdisc_dequeue_head	2016-09-19 01:47:18 -04:00
sch_drr.c	net_sched: gen_estimator: complete rewrite of rate estimators	2016-12-05 15:21:59 -05:00
sch_dsmark.c	sch_dsmark: fix invalid skb_cow() usage	2017-03-21 17:21:27 -07:00
sch_fifo.c	sched: don't use skb queue helpers	2016-09-19 01:47:18 -04:00
sch_fq.c	net_sched: sch_fq: use rb_entry()	2016-12-20 14:22:48 -05:00
sch_fq_codel.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_generic.c	net_sched: check noop_qdisc before qdisc_hash_add()	2017-04-06 12:28:39 -07:00
sch_gred.c	net_sched: drop packets after root qdisc lock is released	2016-06-25 12:19:35 -04:00
sch_hfsc.c	net_sched: gen_estimator: complete rewrite of rate estimators	2016-12-05 15:21:59 -05:00
sch_hhf.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_htb.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_ingress.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_mq.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_mqprio.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_multiq.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_netem.c	net-tc: convert tc_from to tc_from_ingress and tc_redirected	2017-01-08 20:58:52 -05:00
sch_pie.c	sched: replace __skb_dequeue with __qdisc_dequeue_head	2016-09-19 01:47:18 -04:00
sch_plug.c	net_sched: drop packets after root qdisc lock is released	2016-06-25 12:19:35 -04:00
sch_prio.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_qfq.c	net_sched: gen_estimator: complete rewrite of rate estimators	2016-12-05 15:21:59 -05:00
sch_red.c	net_sched: drop packets after root qdisc lock is released	2016-06-25 12:19:35 -04:00
sch_sfb.c	sched: move tcf_proto_destroy and tcf_destroy_chain helpers into cls_api	2017-02-10 11:38:08 -05:00
sch_sfq.c	net_sched: fix error recovery at qdisc creation	2017-02-11 21:38:58 -05:00
sch_tbf.c	net_sched: drop packets after root qdisc lock is released	2016-06-25 12:19:35 -04:00
sch_teql.c	net: make ndo_get_stats64 a void function	2017-01-08 17:51:44 -05:00