bpf: fix arraymap NULL deref and missing overflow and zero size checks
[deliverable/linux.git] / net / sched / cls_basic.c
CommitLineData
1da177e4
LT
1/*
2 * net/sched/cls_basic.c Basic Packet Classifier.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version
7 * 2 of the License, or (at your option) any later version.
8 *
9 * Authors: Thomas Graf <tgraf@suug.ch>
10 */
11
1da177e4 12#include <linux/module.h>
5a0e3ad6 13#include <linux/slab.h>
1da177e4
LT
14#include <linux/types.h>
15#include <linux/kernel.h>
1da177e4 16#include <linux/string.h>
1da177e4
LT
17#include <linux/errno.h>
18#include <linux/rtnetlink.h>
19#include <linux/skbuff.h>
dc5fc579 20#include <net/netlink.h>
1da177e4
LT
21#include <net/act_api.h>
22#include <net/pkt_cls.h>
23
cc7ec456 24struct basic_head {
1da177e4
LT
25 u32 hgenerator;
26 struct list_head flist;
9888faef 27 struct rcu_head rcu;
1da177e4
LT
28};
29
cc7ec456 30struct basic_filter {
1da177e4
LT
31 u32 handle;
32 struct tcf_exts exts;
33 struct tcf_ematch_tree ematches;
34 struct tcf_result res;
9888faef 35 struct tcf_proto *tp;
1da177e4 36 struct list_head link;
9888faef 37 struct rcu_head rcu;
1da177e4
LT
38};
39
dc7f9f6e 40static int basic_classify(struct sk_buff *skb, const struct tcf_proto *tp,
1da177e4
LT
41 struct tcf_result *res)
42{
43 int r;
9888faef 44 struct basic_head *head = rcu_dereference_bh(tp->root);
1da177e4
LT
45 struct basic_filter *f;
46
9888faef 47 list_for_each_entry_rcu(f, &head->flist, link) {
1da177e4
LT
48 if (!tcf_em_tree_match(skb, &f->ematches, NULL))
49 continue;
50 *res = f->res;
51 r = tcf_exts_exec(skb, &f->exts, res);
52 if (r < 0)
53 continue;
54 return r;
55 }
56 return -1;
57}
58
59static unsigned long basic_get(struct tcf_proto *tp, u32 handle)
60{
61 unsigned long l = 0UL;
9888faef 62 struct basic_head *head = rtnl_dereference(tp->root);
1da177e4
LT
63 struct basic_filter *f;
64
65 if (head == NULL)
66 return 0UL;
67
68 list_for_each_entry(f, &head->flist, link)
69 if (f->handle == handle)
70 l = (unsigned long) f;
71
72 return l;
73}
74
75static void basic_put(struct tcf_proto *tp, unsigned long f)
76{
77}
78
79static int basic_init(struct tcf_proto *tp)
80{
d3fa76ee
PM
81 struct basic_head *head;
82
83 head = kzalloc(sizeof(*head), GFP_KERNEL);
84 if (head == NULL)
85 return -ENOBUFS;
86 INIT_LIST_HEAD(&head->flist);
9888faef 87 rcu_assign_pointer(tp->root, head);
1da177e4
LT
88 return 0;
89}
90
9888faef 91static void basic_delete_filter(struct rcu_head *head)
1da177e4 92{
9888faef 93 struct basic_filter *f = container_of(head, struct basic_filter, rcu);
9888faef 94
18d0264f 95 tcf_exts_destroy(&f->exts);
82a470f1 96 tcf_em_tree_destroy(&f->ematches);
1da177e4
LT
97 kfree(f);
98}
99
100static void basic_destroy(struct tcf_proto *tp)
101{
9888faef 102 struct basic_head *head = rtnl_dereference(tp->root);
1da177e4 103 struct basic_filter *f, *n;
10297b99 104
1da177e4 105 list_for_each_entry_safe(f, n, &head->flist, link) {
9888faef 106 list_del_rcu(&f->link);
18cdb37e 107 tcf_unbind_filter(tp, &f->res);
9888faef 108 call_rcu(&f->rcu, basic_delete_filter);
1da177e4 109 }
9888faef
JF
110 RCU_INIT_POINTER(tp->root, NULL);
111 kfree_rcu(head, rcu);
1da177e4
LT
112}
113
114static int basic_delete(struct tcf_proto *tp, unsigned long arg)
115{
9888faef 116 struct basic_head *head = rtnl_dereference(tp->root);
1da177e4
LT
117 struct basic_filter *t, *f = (struct basic_filter *) arg;
118
119 list_for_each_entry(t, &head->flist, link)
120 if (t == f) {
9888faef 121 list_del_rcu(&t->link);
18cdb37e 122 tcf_unbind_filter(tp, &t->res);
9888faef 123 call_rcu(&t->rcu, basic_delete_filter);
1da177e4
LT
124 return 0;
125 }
126
127 return -ENOENT;
128}
129
6fa8c014
PM
130static const struct nla_policy basic_policy[TCA_BASIC_MAX + 1] = {
131 [TCA_BASIC_CLASSID] = { .type = NLA_U32 },
132 [TCA_BASIC_EMATCHES] = { .type = NLA_NESTED },
133};
134
c1b52739
BL
135static int basic_set_parms(struct net *net, struct tcf_proto *tp,
136 struct basic_filter *f, unsigned long base,
137 struct nlattr **tb,
2f7ef2f8 138 struct nlattr *est, bool ovr)
1da177e4 139{
6459082a 140 int err;
1da177e4
LT
141 struct tcf_exts e;
142 struct tcf_ematch_tree t;
143
5da57f42 144 tcf_exts_init(&e, TCA_BASIC_ACT, TCA_BASIC_POLICE);
2f7ef2f8 145 err = tcf_exts_validate(net, tp, tb, est, &e, ovr);
1da177e4
LT
146 if (err < 0)
147 return err;
148
add93b61 149 err = tcf_em_tree_validate(tp, tb[TCA_BASIC_EMATCHES], &t);
1da177e4
LT
150 if (err < 0)
151 goto errout;
152
add93b61 153 if (tb[TCA_BASIC_CLASSID]) {
1587bac4 154 f->res.classid = nla_get_u32(tb[TCA_BASIC_CLASSID]);
1da177e4
LT
155 tcf_bind_filter(tp, &f->res, base);
156 }
157
158 tcf_exts_change(tp, &f->exts, &e);
159 tcf_em_tree_change(tp, &f->ematches, &t);
9888faef 160 f->tp = tp;
1da177e4
LT
161
162 return 0;
163errout:
18d0264f 164 tcf_exts_destroy(&e);
1da177e4
LT
165 return err;
166}
167
c1b52739 168static int basic_change(struct net *net, struct sk_buff *in_skb,
af4c6641 169 struct tcf_proto *tp, unsigned long base, u32 handle,
2f7ef2f8 170 struct nlattr **tca, unsigned long *arg, bool ovr)
1da177e4 171{
cee63723 172 int err;
9888faef 173 struct basic_head *head = rtnl_dereference(tp->root);
add93b61 174 struct nlattr *tb[TCA_BASIC_MAX + 1];
9888faef
JF
175 struct basic_filter *fold = (struct basic_filter *) *arg;
176 struct basic_filter *fnew;
1da177e4 177
add93b61 178 if (tca[TCA_OPTIONS] == NULL)
1da177e4
LT
179 return -EINVAL;
180
6fa8c014
PM
181 err = nla_parse_nested(tb, TCA_BASIC_MAX, tca[TCA_OPTIONS],
182 basic_policy);
cee63723
PM
183 if (err < 0)
184 return err;
1da177e4 185
9888faef
JF
186 if (fold != NULL) {
187 if (handle && fold->handle != handle)
1da177e4 188 return -EINVAL;
1da177e4
LT
189 }
190
191 err = -ENOBUFS;
9888faef
JF
192 fnew = kzalloc(sizeof(*fnew), GFP_KERNEL);
193 if (fnew == NULL)
1da177e4 194 goto errout;
1da177e4 195
9888faef 196 tcf_exts_init(&fnew->exts, TCA_BASIC_ACT, TCA_BASIC_POLICE);
1da177e4 197 err = -EINVAL;
9888faef
JF
198 if (handle) {
199 fnew->handle = handle;
200 } else if (fold) {
201 fnew->handle = fold->handle;
202 } else {
658270a0 203 unsigned int i = 0x80000000;
1da177e4
LT
204 do {
205 if (++head->hgenerator == 0x7FFFFFFF)
206 head->hgenerator = 1;
207 } while (--i > 0 && basic_get(tp, head->hgenerator));
208
209 if (i <= 0) {
cc7ec456 210 pr_err("Insufficient number of handles\n");
1da177e4
LT
211 goto errout;
212 }
213
9888faef 214 fnew->handle = head->hgenerator;
1da177e4
LT
215 }
216
9888faef 217 err = basic_set_parms(net, tp, fnew, base, tb, tca[TCA_RATE], ovr);
1da177e4
LT
218 if (err < 0)
219 goto errout;
220
9888faef
JF
221 *arg = (unsigned long)fnew;
222
223 if (fold) {
224 list_replace_rcu(&fold->link, &fnew->link);
18cdb37e 225 tcf_unbind_filter(tp, &fold->res);
9888faef
JF
226 call_rcu(&fold->rcu, basic_delete_filter);
227 } else {
228 list_add_rcu(&fnew->link, &head->flist);
229 }
1da177e4
LT
230
231 return 0;
232errout:
9888faef 233 kfree(fnew);
1da177e4
LT
234 return err;
235}
236
237static void basic_walk(struct tcf_proto *tp, struct tcf_walker *arg)
238{
9888faef 239 struct basic_head *head = rtnl_dereference(tp->root);
1da177e4
LT
240 struct basic_filter *f;
241
242 list_for_each_entry(f, &head->flist, link) {
243 if (arg->count < arg->skip)
244 goto skip;
245
246 if (arg->fn(tp, (unsigned long) f, arg) < 0) {
247 arg->stop = 1;
248 break;
249 }
250skip:
251 arg->count++;
252 }
253}
254
832d1d5b 255static int basic_dump(struct net *net, struct tcf_proto *tp, unsigned long fh,
1da177e4
LT
256 struct sk_buff *skb, struct tcmsg *t)
257{
258 struct basic_filter *f = (struct basic_filter *) fh;
4b3550ef 259 struct nlattr *nest;
1da177e4
LT
260
261 if (f == NULL)
262 return skb->len;
263
264 t->tcm_handle = f->handle;
265
4b3550ef
PM
266 nest = nla_nest_start(skb, TCA_OPTIONS);
267 if (nest == NULL)
268 goto nla_put_failure;
1da177e4 269
1b34ec43
DM
270 if (f->res.classid &&
271 nla_put_u32(skb, TCA_BASIC_CLASSID, f->res.classid))
272 goto nla_put_failure;
e1e284a4 273
5da57f42 274 if (tcf_exts_dump(skb, &f->exts) < 0 ||
1da177e4 275 tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0)
add93b61 276 goto nla_put_failure;
1da177e4 277
4b3550ef 278 nla_nest_end(skb, nest);
4c46ee52 279
5da57f42 280 if (tcf_exts_dump_stats(skb, &f->exts) < 0)
4c46ee52 281 goto nla_put_failure;
282
1da177e4
LT
283 return skb->len;
284
add93b61 285nla_put_failure:
4b3550ef 286 nla_nest_cancel(skb, nest);
1da177e4
LT
287 return -1;
288}
289
2eb9d75c 290static struct tcf_proto_ops cls_basic_ops __read_mostly = {
1da177e4
LT
291 .kind = "basic",
292 .classify = basic_classify,
293 .init = basic_init,
294 .destroy = basic_destroy,
295 .get = basic_get,
296 .put = basic_put,
297 .change = basic_change,
298 .delete = basic_delete,
299 .walk = basic_walk,
300 .dump = basic_dump,
301 .owner = THIS_MODULE,
302};
303
304static int __init init_basic(void)
305{
306 return register_tcf_proto_ops(&cls_basic_ops);
307}
308
10297b99 309static void __exit exit_basic(void)
1da177e4
LT
310{
311 unregister_tcf_proto_ops(&cls_basic_ops);
312}
313
314module_init(init_basic)
315module_exit(exit_basic)
316MODULE_LICENSE("GPL");
317
This page took 0.733368 seconds and 5 git commands to generate.