Commit 4760abaa authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'mpr-len-checks' 


David Ahern says:

====================
net: Length checks for attributes within multipath routes

Add length checks for attributes within a multipath route (attributes
within RTA_MULTIPATH). Motivated by the syzbot report in patch 1 and
then expanded to other attributes as noted by Ido.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 74c78b42 8bda81a4

net/core/lwtunnel.c

+4 −0
Original line number Diff line number Diff line
@@ -197,6 +197,10 @@ int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining, 
			nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);



			if (nla_entype) {

				if (nla_len(nla_entype) < sizeof(u16)) {

					NL_SET_ERR_MSG(extack, "Invalid RTA_ENCAP_TYPE");

					return -EINVAL;

				}

				encap_type = nla_get_u16(nla_entype);



				if (lwtunnel_valid_encap_type(encap_type,

net/ipv4/fib_semantics.c

+43 −6
Original line number Diff line number Diff line
@@ -662,6 +662,19 @@ static int fib_count_nexthops(struct rtnexthop *rtnh, int remaining, 
	return nhs;

}



static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla,

			    struct netlink_ext_ack *extack)

{

	if (nla_len(nla) < sizeof(*gw)) {

		NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY");

		return -EINVAL;

	}



	*gw = nla_get_in_addr(nla);



	return 0;

}



/* only called when fib_nh is integrated into fib_info */

static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,

		       int remaining, struct fib_config *cfg,
@@ -704,7 +717,11 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, 
				return -EINVAL;

			}

			if (nla) {

				fib_cfg.fc_gw4 = nla_get_in_addr(nla);

				ret = fib_gw_from_attr(&fib_cfg.fc_gw4, nla,

						       extack);

				if (ret)

					goto errout;



				if (fib_cfg.fc_gw4)

					fib_cfg.fc_gw_family = AF_INET;

			} else if (nlav) {
@@ -714,10 +731,18 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, 
			}



			nla = nla_find(attrs, attrlen, RTA_FLOW);

			if (nla)

			if (nla) {

				if (nla_len(nla) < sizeof(u32)) {

					NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");

					return -EINVAL;

				}

				fib_cfg.fc_flow = nla_get_u32(nla);

			}



			fib_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);

			/* RTA_ENCAP_TYPE length checked in

			 * lwtunnel_valid_encap_type_attr

			 */

			nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);

			if (nla)

				fib_cfg.fc_encap_type = nla_get_u16(nla);
@@ -902,6 +927,7 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, 
		attrlen = rtnh_attrlen(rtnh);

		if (attrlen > 0) {

			struct nlattr *nla, *nlav, *attrs = rtnh_attrs(rtnh);

			int err;



			nla = nla_find(attrs, attrlen, RTA_GATEWAY);

			nlav = nla_find(attrs, attrlen, RTA_VIA);
@@ -912,12 +938,17 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, 
			}



			if (nla) {

				__be32 gw;



				err = fib_gw_from_attr(&gw, nla, extack);

				if (err)

					return err;



				if (nh->fib_nh_gw_family != AF_INET ||

				    nla_get_in_addr(nla) != nh->fib_nh_gw4)

				    gw != nh->fib_nh_gw4)

					return 1;

			} else if (nlav) {

				struct fib_config cfg2;

				int err;



				err = fib_gw_from_via(&cfg2, nlav, extack);

				if (err)
@@ -940,8 +971,14 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, 


#ifdef CONFIG_IP_ROUTE_CLASSID

			nla = nla_find(attrs, attrlen, RTA_FLOW);

			if (nla && nla_get_u32(nla) != nh->nh_tclassid)

			if (nla) {

				if (nla_len(nla) < sizeof(u32)) {

					NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");

					return -EINVAL;

				}

				if (nla_get_u32(nla) != nh->nh_tclassid)

					return 1;

			}

#endif

		}

net/ipv6/route.c

+29 −2
Original line number Diff line number Diff line
@@ -5224,6 +5224,19 @@ static bool ip6_route_mpath_should_notify(const struct fib6_info *rt) 
	return should_notify;

}



static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla,

			     struct netlink_ext_ack *extack)

{

	if (nla_len(nla) < sizeof(*gw)) {

		NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY");

		return -EINVAL;

	}



	*gw = nla_get_in6_addr(nla);



	return 0;

}



static int ip6_route_multipath_add(struct fib6_config *cfg,

				   struct netlink_ext_ack *extack)

{
@@ -5264,10 +5277,20 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, 


			nla = nla_find(attrs, attrlen, RTA_GATEWAY);

			if (nla) {

				r_cfg.fc_gateway = nla_get_in6_addr(nla);

				int ret;



				ret = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,

							extack);

				if (ret)

					return ret;



				r_cfg.fc_flags |= RTF_GATEWAY;

			}

			r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);



			/* RTA_ENCAP_TYPE length checked in

			 * lwtunnel_valid_encap_type_attr

			 */

			nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);

			if (nla)

				r_cfg.fc_encap_type = nla_get_u16(nla);
@@ -5434,7 +5457,11 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, 


			nla = nla_find(attrs, attrlen, RTA_GATEWAY);

			if (nla) {

				nla_memcpy(&r_cfg.fc_gateway, nla, 16);

				err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,

							extack);

				if (err)

					return err;



				r_cfg.fc_flags |= RTF_GATEWAY;

			}

		}