net: sched: Add policy validation for tc attributes

[ Upstream commit 8b4c3cdd9dd8290343ce959a132d3b334062c5b9 ]

A number of TC attributes are processed without proper validation
(e.g., length checks). Add a tca policy for all input attributes and use
when invoking nlmsg_parse.

The 2 Fixes tags below cover the latest additions. The other attributes
are a string (KIND), nested attribute (OPTIONS which does seem to have
validation in most cases), for dumps only or a flag.

Fixes: 5bc1701881e39 ("net: sched: introduce multichain support for filters")
Fixes: d47a6b0e7c492 ("net: sched: introduce ingress/egress block index attributes for qdisc")
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 22bc6fc4831116d75027a3871e7854e07b823d71..cd69aa067543097bc0764d8ee645a4d63014d34d 100644 (file)
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1216,6 +1216,16 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
  * Delete/get qdisc.
  */
 
+const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
+       [TCA_KIND]              = { .type = NLA_STRING },
+       [TCA_OPTIONS]           = { .type = NLA_NESTED },
+       [TCA_RATE]              = { .type = NLA_BINARY,
+                                   .len = sizeof(struct tc_estimator) },
+       [TCA_STAB]              = { .type = NLA_NESTED },
+       [TCA_DUMP_INVISIBLE]    = { .type = NLA_FLAG },
+       [TCA_CHAIN]             = { .type = NLA_U32 },
+};
+
 static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
                        struct netlink_ext_ack *extack)
 {
@@ -1232,7 +1242,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
            !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                return -EPERM;
 
-       err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
+       err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
+                         extack);
        if (err < 0)
                return err;
 
@@ -1302,7 +1313,8 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
 
 replay:
        /* Reinit, just in case something touches this. */
-       err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
+       err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
+                         extack);
        if (err < 0)
                return err;
 
@@ -1512,7 +1524,8 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
        idx = 0;
        ASSERT_RTNL();
 
-       err = nlmsg_parse(nlh, sizeof(*tcm), tca, TCA_MAX, NULL, NULL);
+       err = nlmsg_parse(nlh, sizeof(*tcm), tca, TCA_MAX,
+                         rtm_tca_policy, NULL);
        if (err < 0)
                return err;
 
@@ -1729,7 +1742,8 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,
            !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                return -EPERM;
 
-       err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL, extack);
+       err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, rtm_tca_policy,
+                         extack);
        if (err < 0)
                return err;