diff options
| author | Borislav Petkov <bp@suse.de> | 2018-09-27 18:36:24 +0200 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2018-09-27 18:36:24 +0200 |
| commit | d913e8966a8f4b259dd6f11f0c334d865cf9d3aa (patch) | |
| tree | 0b354028600f61001317426da875edc50685d36d /net/sched/cls_u32.c | |
| parent | 6b58859419554fb824e09cfdd73151a195473cbc (diff) | |
| parent | c9661c1e80b609cd038db7c908e061f0535804ef (diff) | |
Merge branch 'tip-x86-hygon' into edac-for-4.20
... to pick up a dependent commit and share it with the tip tree, branch
tip:x86/cpu.
Signed-off-by: Borislav Petkov <bp@suse.de>
Diffstat (limited to 'net/sched/cls_u32.c')
| -rw-r--r-- | net/sched/cls_u32.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index d5d2a6dc3921..f218ccf1e2d9 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -914,6 +914,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, struct nlattr *opt = tca[TCA_OPTIONS]; struct nlattr *tb[TCA_U32_MAX + 1]; u32 htid, flags = 0; + size_t sel_size; int err; #ifdef CONFIG_CLS_U32_PERF size_t size; @@ -1076,8 +1077,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, } s = nla_data(tb[TCA_U32_SEL]); + sel_size = struct_size(s, keys, s->nkeys); + if (nla_len(tb[TCA_U32_SEL]) < sel_size) { + err = -EINVAL; + goto erridr; + } - n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL); + n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL); if (n == NULL) { err = -ENOBUFS; goto erridr; @@ -1092,7 +1098,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, } #endif - memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key)); + memcpy(&n->sel, s, sel_size); RCU_INIT_POINTER(n->ht_up, ht); n->handle = handle; n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0; |