From: Florian Fainelli Date: Sun, 11 Apr 2010 20:51:37 +0000 (+0000) Subject: swconfig: Check vlan/port indexes for validity. X-Git-Tag: reboot~20268 X-Git-Url: http://git.openwrt.org/?p=openwrt%2Fopenwrt.git;a=commitdiff_plain;h=fba1a0a074e6d00ca96597d5ed701ef0efce371e swconfig: Check vlan/port indexes for validity. Swconfig needs to make sure that requested vlans/ports actually exist, else it might read or modify memory not belonging to itself. This patch adds a quick range check in swconfig's kernel part to prevent accidential or intentional memory modification. Signed-off-by: Jonas Gorski SVN-Revision: 20811 --- diff --git a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c index 7207e46592..bb49df83eb 100644 --- a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c +++ b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c @@ -463,6 +463,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info, if (!info->attrs[SWITCH_ATTR_OP_VLAN]) goto done; val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_VLAN]); + if (val->port_vlan >= dev->vlans) + goto done; break; case SWITCH_CMD_SET_PORT: case SWITCH_CMD_GET_PORT: @@ -473,6 +475,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info, if (!info->attrs[SWITCH_ATTR_OP_PORT]) goto done; val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_PORT]); + if (val->port_vlan >= dev->ports) + goto done; break; default: WARN_ON(1);