@@ -1617,6 +1617,19 @@ static struct macsec_rx_sa *get_rxsa_from_nl(struct net *net,
return rx_sa;
}
+static int validate_pn(const struct nlattr *attr,
+ struct netlink_ext_ack *extack)
+{
+ if (nla_len(attr) == MACSEC_DEFAULT_PN_LEN ||
+ nla_len(attr) == MACSEC_XPN_PN_LEN) {
+ if (nla_get_u64(attr) == 0)
+ return -EINVAL;
+ return 0;
+ }
+
+ return -EINVAL;
+}
+
static const struct nla_policy macsec_genl_policy[NUM_MACSEC_ATTR] = {
[MACSEC_ATTR_IFINDEX] = { .type = NLA_U32 },
[MACSEC_ATTR_RXSC_CONFIG] = { .type = NLA_NESTED },
@@ -1632,7 +1645,7 @@ static const struct nla_policy macsec_genl_rxsc_policy[NUM_MACSEC_RXSC_ATTR] = {
static const struct nla_policy macsec_genl_sa_policy[NUM_MACSEC_SA_ATTR] = {
[MACSEC_SA_ATTR_AN] = NLA_POLICY_MAX(NLA_U8, MACSEC_NUM_AN - 1),
[MACSEC_SA_ATTR_ACTIVE] = NLA_POLICY_MAX(NLA_U8, 1),
- [MACSEC_SA_ATTR_PN] = NLA_POLICY_MIN_LEN(4),
+ [MACSEC_SA_ATTR_PN] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_pn, 8),
[MACSEC_SA_ATTR_KEYID] = NLA_POLICY_EXACT_LEN(MACSEC_KEYID_LEN),
[MACSEC_SA_ATTR_KEY] = { .type = NLA_BINARY,
.len = MACSEC_MAX_KEY_LEN, },
@@ -1693,10 +1706,6 @@ static bool validate_add_rxsa(struct nlattr **attrs)
!attrs[MACSEC_SA_ATTR_KEYID])
return false;
- if (attrs[MACSEC_SA_ATTR_PN] &&
- nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) == 0)
- return false;
-
return true;
}
@@ -1913,9 +1922,6 @@ static bool validate_add_txsa(struct nlattr **attrs)
!attrs[MACSEC_SA_ATTR_KEYID])
return false;
- if (nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) == 0)
- return false;
-
return true;
}
@@ -2248,9 +2254,6 @@ static bool validate_upd_sa(struct nlattr **attrs)
attrs[MACSEC_SA_ATTR_SALT])
return false;
- if (attrs[MACSEC_SA_ATTR_PN] && nla_get_u64(attrs[MACSEC_SA_ATTR_PN]) == 0)
- return false;
-
return true;
}
We need to keep the length checks done in macsec_{add,upd}_{rx,tx}sa based on whether the device is set up for XPN (with 64b PNs instead of 32b), but we can at least check early and that the length is not completely bogus and whether the PN is 0. Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> --- drivers/net/macsec.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)