From b02fa11a17a01d456ef0b71fb9d3725a6e0ed264 Mon Sep 17 00:00:00 2001 From: florian Date: Sun, 11 Apr 2010 20:51:37 +0000 Subject: [kernel] swconfig: Check vlan/port indexes for validity. Swconfig needs to make sure that requested vlans/ports actually exist, else it might read or modify memory not belonging to itself. This patch adds a quick range check in swconfig's kernel part to prevent accidential or intentional memory modification. Signed-off-by: Jonas Gorski git-svn-id: svn://svn.openwrt.org/openwrt/trunk@20811 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- target/linux/generic-2.6/files/drivers/net/phy/swconfig.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'target/linux/generic-2.6/files/drivers/net') diff --git a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c index 7207e46592..bb49df83eb 100644 --- a/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c +++ b/target/linux/generic-2.6/files/drivers/net/phy/swconfig.c @@ -463,6 +463,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info, if (!info->attrs[SWITCH_ATTR_OP_VLAN]) goto done; val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_VLAN]); + if (val->port_vlan >= dev->vlans) + goto done; break; case SWITCH_CMD_SET_PORT: case SWITCH_CMD_GET_PORT: @@ -473,6 +475,8 @@ swconfig_lookup_attr(struct switch_dev *dev, struct genl_info *info, if (!info->attrs[SWITCH_ATTR_OP_PORT]) goto done; val->port_vlan = nla_get_u32(info->attrs[SWITCH_ATTR_OP_PORT]); + if (val->port_vlan >= dev->ports) + goto done; break; default: WARN_ON(1); -- cgit v1.2.3