diff options
| author | Minoru Usui <usui@mxm.nes.nec.co.jp> | 2009-06-09 13:03:09 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-06-09 13:03:09 +0200 |
| commit | 52ea3a56a3268bc2a5a7c75e98c81463004e38ef (patch) | |
| tree | 4f99bbf8015d252c1a145a1b610db9eddb192f98 /net/sched | |
| parent | r8169: fix crash when large packets are received (diff) | |
| download | linux-52ea3a56a3268bc2a5a7c75e98c81463004e38ef.tar.xz linux-52ea3a56a3268bc2a5a7c75e98c81463004e38ef.zip | |
cls_cgroup: Fix oops when user send improperly 'tc filter add' request
I found a bug in cls_cgroup_change() in cls_cgroup.c.
cls_cgroup_change() expected tca[TCA_OPTIONS] was set from user space properly,
but tc in iproute2-2.6.29-1 (which I used) didn't set it.
In the current source code of tc in git, it set tca[TCA_OPTIONS].
git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git
If we always use a newest iproute2 in git when we use cls_cgroup,
we don't face this oops probably.
But I think, kernel shouldn't panic regardless of use program's behaviour.
Signed-off-by: Minoru Usui <usui@mxm.nes.nec.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/cls_cgroup.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c index cc29b44b1500..e5becb92b3e7 100644 --- a/net/sched/cls_cgroup.c +++ b/net/sched/cls_cgroup.c @@ -167,6 +167,9 @@ static int cls_cgroup_change(struct tcf_proto *tp, unsigned long base, struct tcf_exts e; int err; + if (!tca[TCA_OPTIONS]) + return -EINVAL; + if (head == NULL) { if (!handle) return -EINVAL; |