From patchwork Tue Oct 1 10:32:17 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrea Claudi X-Patchwork-Id: 1169827 X-Patchwork-Delegate: shemminger@vyatta.com Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 46jFtP2kfgz9sPd for ; Tue, 1 Oct 2019 20:31:24 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730246AbfJAKbX (ORCPT ); Tue, 1 Oct 2019 06:31:23 -0400 Received: from mx1.redhat.com ([209.132.183.28]:44778 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725765AbfJAKbX (ORCPT ); Tue, 1 Oct 2019 06:31:23 -0400 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 98757A44AC3; Tue, 1 Oct 2019 10:31:23 +0000 (UTC) Received: from renaissance-vector.mxp.redhat.com (unknown [10.32.181.34]) by smtp.corp.redhat.com (Postfix) with ESMTP id C1729261A0; Tue, 1 Oct 2019 10:31:22 +0000 (UTC) From: Andrea Claudi To: netdev@vger.kernel.org Cc: stephen@networkplumber.org, dsahern@gmail.com Subject: [PATCH iproute2] tc: fix segmentation fault on gact action Date: Tue, 1 Oct 2019 12:32:17 +0200 Message-Id: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (mx1.redhat.com [10.5.110.68]); Tue, 01 Oct 2019 10:31:23 +0000 (UTC) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org tc segfaults if gact action is used without action or index: $ ip link add type dummy $ tc actions add action pipe index 1 $ tc filter add dev dummy0 parent ffff: protocol ip \ pref 10 u32 match ip src 127.0.0.2 flowid 1:10 action gact Segmentation fault We expect tc to fail gracefully with an error message. This happens if gact is the last argument of the incomplete command. In this case the "gact" action is parsed, the macro NEXT_ARG_FWD() is executed and the next matches() crashes because of null argv pointer. To avoid this, simply use NEXT_ARG() instead. With this change in place: $ ip link add type dummy $ tc actions add action pipe index 1 $ tc filter add dev dummy0 parent ffff: protocol ip \ pref 10 u32 match ip src 127.0.0.2 flowid 1:10 action gact Command line is not complete. Try option "help" Fixes: fa4958897314 ("tc: Fix binding of gact action by index.") Reported-by: Davide Caratti Signed-off-by: Andrea Claudi --- tc/m_gact.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tc/m_gact.c b/tc/m_gact.c index dca2a2f9692fd..b06e8ee95818f 100644 --- a/tc/m_gact.c +++ b/tc/m_gact.c @@ -87,7 +87,7 @@ parse_gact(struct action_util *a, int *argc_p, char ***argv_p, return -1; if (!matches(*argv, "gact")) - NEXT_ARG_FWD(); + NEXT_ARG(); /* we're binding existing gact action to filter by index. */ if (!matches(*argv, "index")) goto skip_args;