aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/generic-2.6/files
diff options
context:
space:
mode:
authorFlorian Fainelli <florian@openwrt.org>2010-04-11 20:51:37 +0000
committerFlorian Fainelli <florian@openwrt.org>2010-04-11 20:51:37 +0000
commitfba1a0a074e6d00ca96597d5ed701ef0efce371e (patch)
tree7d1358021492385e4ba5d9019bba297b371b2d18 /target/linux/generic-2.6/files
parent2de2c9ead215bc4fcb7fb509051a3720ead957aa (diff)
downloadupstream-fba1a0a074e6d00ca96597d5ed701ef0efce371e.tar.gz
upstream-fba1a0a074e6d00ca96597d5ed701ef0efce371e.tar.bz2
upstream-fba1a0a074e6d00ca96597d5ed701ef0efce371e.zip
swconfig: Check vlan/port indexes for validity.
Swconfig needs to make sure that requested vlans/ports actually exist, else it might read or modify memory not belonging to itself. This patch adds a quick range check in swconfig's kernel part to prevent accidential or intentional memory modification. Signed-off-by: Jonas Gorski <jonas.gorski+openwrt@gmail.com> SVN-Revision: 20811
Diffstat (limited to 'target/linux/generic-2.6/files')
-rw-r--r--target/linux/generic-2.6/files/drivers/net/phy/swconfig.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c
index 7207e46592..bb49df83eb 100644
--- a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c
+++ b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c
@@ -463,6 +463,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info,
if (!info->attrs[SWITCH_ATTR_OP_VLAN])
goto done;
val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_VLAN]);
+ if (val->port_vlan >= dev->vlans)
+ goto done;
break;
case SWITCH_CMD_SET_PORT:
case SWITCH_CMD_GET_PORT:
@@ -473,6 +475,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info,
if (!info->attrs[SWITCH_ATTR_OP_PORT])
goto done;
val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_PORT]);
+ if (val->port_vlan >= dev->ports)
+ goto done;
break;
default:
WARN_ON(1);