| Message ID | 20240502155751.75705-1-rzats@paloaltonetworks.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1aec77b2bb2ed1db0f5efc61c4c1ca3813307489 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation | expand |
Roded Zats <rzats@paloaltonetworks.com> writes: > Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a > struct ifla_vf_vlan_info so the size of such attribute needs to be at least > of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. > The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) > which is less than sizeof(struct ifla_vf_vlan_info) so this validation > is not enough and a too small attribute might be cast to a > struct ifla_vf_vlan_info, this might result in an out of bands > read access when accessing the saved (casted) entry in ivvl. > > Fixes: 79aab093a0b5 ("net: Update API for VF vlan protocol 802.1ad support") > Signed-off-by: Roded Zats <rzats@paloaltonetworks.com> Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Thu, 2 May 2024 18:57:51 +0300 you wrote: > Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a > struct ifla_vf_vlan_info so the size of such attribute needs to be at least > of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. > The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) > which is less than sizeof(struct ifla_vf_vlan_info) so this validation > is not enough and a too small attribute might be cast to a > struct ifla_vf_vlan_info, this might result in an out of bands > read access when accessing the saved (casted) entry in ivvl. > > [...] Here is the summary with links: - [net] rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation https://git.kernel.org/netdev/net/c/1aec77b2bb2e You are awesome, thank you!
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index a3d7847ce69d..8ba6a4e4be26 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -2530,7 +2530,7 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb) nla_for_each_nested(attr, tb[IFLA_VF_VLAN_LIST], rem) { if (nla_type(attr) != IFLA_VF_VLAN_INFO || - nla_len(attr) < NLA_HDRLEN) { + nla_len(attr) < sizeof(struct ifla_vf_vlan_info)) { return -EINVAL; } if (len >= MAX_VLAN_LIST_LEN)
Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl. Fixes: 79aab093a0b5 ("net: Update API for VF vlan protocol 802.1ad support") Signed-off-by: Roded Zats <rzats@paloaltonetworks.com> --- net/core/rtnetlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)