ip_tunnel: Add missing validation of encap type to ip_tunnel_encap_setup()
authorThomas Graf <tgraf@suug.ch>
Tue, 16 Dec 2014 20:05:21 +0000 (21:05 +0100)
committerDavid S. Miller <davem@davemloft.net>
Tue, 16 Dec 2014 20:20:41 +0000 (15:20 -0500)
The encap->type comes straight from Netlink. Validate it against
max supported encap types just like ip_encap_hlen() already does.

Fixes: a8c5f9 ("ip_tunnel: Ops registration for secondary encap (fou, gue)")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ip_tunnel.c

index 2f498f87e3d886b6f7ff8145b5492e32ad38126c..d3e4479367208cd16d4ea50b012e23bfafa76357 100644 (file)
@@ -573,6 +573,9 @@ int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t,
        if (t->encap.type == TUNNEL_ENCAP_NONE)
                return 0;
 
+       if (t->encap.type >= MAX_IPTUN_ENCAP_OPS)
+               return -EINVAL;
+
        rcu_read_lock();
        ops = rcu_dereference(iptun_encaps[t->encap.type]);
        if (likely(ops && ops->build_header))