Skip to content

Commit

Permalink
Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
Browse files Browse the repository at this point in the history
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [PKT_SCHED]: Fix error handling while dumping actions
  [PKT_SCHED]: Return ENOENT if action module is unavailable
  [PKT_SCHED]: Fix illegal memory dereferences when dumping actions
  • Loading branch information
Linus Torvalds committed Jul 6, 2006
2 parents e2a305e + 4fe683f commit 075d6ad
Showing 1 changed file with 10 additions and 8 deletions.
18 changes: 10 additions & 8 deletions net/sched/act_api.c
Original file line number Diff line number Diff line change
Expand Up @@ -250,15 +250,17 @@ tcf_action_dump(struct sk_buff *skb, struct tc_action *act, int bind, int ref)
RTA_PUT(skb, a->order, 0, NULL);
err = tcf_action_dump_1(skb, a, bind, ref);
if (err < 0)
goto rtattr_failure;
goto errout;
r->rta_len = skb->tail - (u8*)r;
}

return 0;

rtattr_failure:
err = -EINVAL;
errout:
skb_trim(skb, b - skb->data);
return -err;
return err;
}

struct tc_action *tcf_action_init_1(struct rtattr *rta, struct rtattr *est,
Expand Down Expand Up @@ -305,6 +307,7 @@ struct tc_action *tcf_action_init_1(struct rtattr *rta, struct rtattr *est,
goto err_mod;
}
#endif
*err = -ENOENT;
goto err_out;
}

Expand Down Expand Up @@ -776,7 +779,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
return ret;
}

static char *
static struct rtattr *
find_dump_kind(struct nlmsghdr *n)
{
struct rtattr *tb1, *tb2[TCA_ACT_MAX+1];
Expand Down Expand Up @@ -804,7 +807,7 @@ find_dump_kind(struct nlmsghdr *n)
return NULL;
kind = tb2[TCA_ACT_KIND-1];

return (char *) RTA_DATA(kind);
return kind;
}

static int
Expand All @@ -817,24 +820,23 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
struct tc_action a;
int ret = 0;
struct tcamsg *t = (struct tcamsg *) NLMSG_DATA(cb->nlh);
char *kind = find_dump_kind(cb->nlh);
struct rtattr *kind = find_dump_kind(cb->nlh);

if (kind == NULL) {
printk("tc_dump_action: action bad kind\n");
return 0;
}

a_o = tc_lookup_action_n(kind);
a_o = tc_lookup_action(kind);
if (a_o == NULL) {
printk("failed to find %s\n", kind);
return 0;
}

memset(&a, 0, sizeof(struct tc_action));
a.ops = a_o;

if (a_o->walk == NULL) {
printk("tc_dump_action: %s !capable of dumping table\n", kind);
printk("tc_dump_action: %s !capable of dumping table\n", a_o->kind);
goto rtattr_failure;
}

Expand Down

0 comments on commit 075d6ad

Please sign in to comment.