[PATCH 4.9 17/39] net/sched: act_simple: fix parsing of TCA_DEF_DATA

[Greg Kroah-Hartman]

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Davide Caratti <dcara...@redhat.com>

[ Upstream commit 8d499533e0bc02d44283dbdab03142b599b8ba16 ]

use nla_strlcpy() to avoid copying data beyond the length of TCA_DEF_DATA
netlink attribute, in case it is less than SIMP_MAX_DATA and it does not
end with '\0' character.

v2: fix errors in the commit message, thanks Hangbin Liu

Fixes: fa1b1cff3d06 ("net_cls_act: Make act_simple use of netlink policy.")
Signed-off-by: Davide Caratti <dcara...@redhat.com>
Reviewed-by: Simon Horman <simon.hor...@netronome.com>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 net/sched/act_simple.c |   15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -55,22 +55,22 @@ static void tcf_simp_release(struct tc_a
        kfree(d->tcfd_defdata);
 }
 
-static int alloc_defdata(struct tcf_defact *d, char *defdata)
+static int alloc_defdata(struct tcf_defact *d, const struct nlattr *defdata)
 {
        d->tcfd_defdata = kzalloc(SIMP_MAX_DATA, GFP_KERNEL);
        if (unlikely(!d->tcfd_defdata))
                return -ENOMEM;
-       strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
+       nla_strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
        return 0;
 }
 
-static void reset_policy(struct tcf_defact *d, char *defdata,
+static void reset_policy(struct tcf_defact *d, const struct nlattr *defdata,
                         struct tc_defact *p)
 {
        spin_lock_bh(&d->tcf_lock);
        d->tcf_action = p->action;
        memset(d->tcfd_defdata, 0, SIMP_MAX_DATA);
-       strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
+       nla_strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
        spin_unlock_bh(&d->tcf_lock);
 }
 
@@ -89,7 +89,6 @@ static int tcf_simp_init(struct net *net
        struct tcf_defact *d;
        bool exists = false;
        int ret = 0, err;
-       char *defdata;
 
        if (nla == NULL)
                return -EINVAL;
@@ -112,8 +111,6 @@ static int tcf_simp_init(struct net *net
                return -EINVAL;
        }
 
-       defdata = nla_data(tb[TCA_DEF_DATA]);
-
        if (!exists) {
                ret = tcf_hash_create(tn, parm->index, est, a,
                                      &act_simp_ops, bind, false);
@@ -121,7 +118,7 @@ static int tcf_simp_init(struct net *net
                        return ret;
 
                d = to_defact(*a);
-               ret = alloc_defdata(d, defdata);
+               ret = alloc_defdata(d, tb[TCA_DEF_DATA]);
                if (ret < 0) {
                        tcf_hash_cleanup(*a, est);
                        return ret;
@@ -135,7 +132,7 @@ static int tcf_simp_init(struct net *net
                if (!ovr)
                        return -EEXIST;
 
-               reset_policy(d, defdata, parm);
+               reset_policy(d, tb[TCA_DEF_DATA], parm);
        }
 
        if (ret == ACT_P_CREATED)