diff options
| author | Florian Fainelli <florian@openwrt.org> | 2010-04-11 20:51:37 +0000 |
|---|---|---|
| committer | Florian Fainelli <florian@openwrt.org> | 2010-04-11 20:51:37 +0000 |
| commit | fba1a0a074e6d00ca96597d5ed701ef0efce371e (patch) | |
| tree | 7d1358021492385e4ba5d9019bba297b371b2d18 /target | |
| parent | 2de2c9ead215bc4fcb7fb509051a3720ead957aa (diff) | |
| download | upstream-fba1a0a074e6d00ca96597d5ed701ef0efce371e.tar.gz upstream-fba1a0a074e6d00ca96597d5ed701ef0efce371e.tar.bz2 upstream-fba1a0a074e6d00ca96597d5ed701ef0efce371e.zip | |
swconfig: Check vlan/port indexes for validity.
Swconfig needs to make sure that requested vlans/ports actually exist,
else it might read or modify memory not belonging to itself.
This patch adds a quick range check in swconfig's kernel part to
prevent accidential or intentional memory modification.
Signed-off-by: Jonas Gorski <jonas.gorski+openwrt@gmail.com>
SVN-Revision: 20811
Diffstat (limited to 'target')
| -rw-r--r-- | target/linux/generic-2.6/files/drivers/net/phy/swconfig.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c index 7207e46592..bb49df83eb 100644 --- a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c +++ b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c @@ -463,6 +463,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info, if (!info->attrs[SWITCH_ATTR_OP_VLAN]) goto done; val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_VLAN]); + if (val->port_vlan >= dev->vlans) + goto done; break; case SWITCH_CMD_SET_PORT: case SWITCH_CMD_GET_PORT: @@ -473,6 +475,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info, if (!info->attrs[SWITCH_ATTR_OP_PORT]) goto done; val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_PORT]); + if (val->port_vlan >= dev->ports) + goto done; break; default: WARN_ON(1); |