forked from luck/tmp_suning_uos_patched
3bf4b5b11d
In function __parse_flow_nlattrs(), we check for condition
(type > OVS_KEY_ATTR_MAX) and if true, print an error, but we do
not return from this function as in other checks. It seems this
has been forgotten, as otherwise, we could access beyond the
memory of ovs_key_lens, which is of ovs_key_lens[OVS_KEY_ATTR_MAX + 1].
Hence, a maliciously prepared nla_type from user space could access
beyond this upper limit.
Introduced by
|
||
|---|---|---|
| .. | ||
| actions.c | ||
| datapath.c | ||
| datapath.h | ||
| dp_notify.c | ||
| flow.c | ||
| flow.h | ||
| Kconfig | ||
| Makefile | ||
| vport-gre.c | ||
| vport-internal_dev.c | ||
| vport-internal_dev.h | ||
| vport-netdev.c | ||
| vport-netdev.h | ||
| vport-vxlan.c | ||
| vport.c | ||
| vport.h | ||