Commit 664b9c4b authored by David Ahern's avatar David Ahern Committed by David S. Miller
Browse files

ipv4: Check attribute length for RTA_FLOW in multipath route 



Make sure RTA_FLOW is at least 4B before using.

Fixes: 4e902c57 ("[IPv4]: FIB configuration using struct fib_config")
Signed-off-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7a3429ba

net/ipv4/fib_semantics.c

+14 −3
Original line number Diff line number Diff line
@@ -731,8 +731,13 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, 
			}



			nla = nla_find(attrs, attrlen, RTA_FLOW);

			if (nla)

			if (nla) {

				if (nla_len(nla) < sizeof(u32)) {

					NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");

					return -EINVAL;

				}

				fib_cfg.fc_flow = nla_get_u32(nla);

			}



			fib_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);

			nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
@@ -963,8 +968,14 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, 


#ifdef CONFIG_IP_ROUTE_CLASSID

			nla = nla_find(attrs, attrlen, RTA_FLOW);

			if (nla && nla_get_u32(nla) != nh->nh_tclassid)

			if (nla) {

				if (nla_len(nla) < sizeof(u32)) {

					NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");

					return -EINVAL;

				}

				if (nla_get_u32(nla) != nh->nh_tclassid)

					return 1;

			}

#endif

		}