hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c
kernel/net/sched/cls_flower.c
....@@ -778,6 +778,16 @@
778778 TCA_FLOWER_KEY_PORT_SRC_MAX, &mask->tp_range.tp_max.src,
779779 TCA_FLOWER_UNSPEC, sizeof(key->tp_range.tp_max.src));
780780
781
+ if (mask->tp_range.tp_min.dst != mask->tp_range.tp_max.dst) {
782
+ NL_SET_ERR_MSG(extack,
783
+ "Both min and max destination ports must be specified");
784
+ return -EINVAL;
785
+ }
786
+ if (mask->tp_range.tp_min.src != mask->tp_range.tp_max.src) {
787
+ NL_SET_ERR_MSG(extack,
788
+ "Both min and max source ports must be specified");
789
+ return -EINVAL;
790
+ }
781791 if (mask->tp_range.tp_min.dst && mask->tp_range.tp_max.dst &&
782792 ntohs(key->tp_range.tp_max.dst) <=
783793 ntohs(key->tp_range.tp_min.dst)) {
....@@ -1086,6 +1096,9 @@
10861096 if (option_len > sizeof(struct geneve_opt))
10871097 data_len = option_len - sizeof(struct geneve_opt);
10881098
1099
+ if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4)
1100
+ return -ERANGE;
1101
+
10891102 opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len];
10901103 memset(opt, 0xff, option_len);
10911104 opt->length = data_len / 4;