Skip to content
Commit 1aec77b2 authored by Roded Zats's avatar Roded Zats Committed by Jakub Kicinski
Browse files

rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation



Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
struct ifla_vf_vlan_info so the size of such attribute needs to be at least
of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
which is less than sizeof(struct ifla_vf_vlan_info) so this validation
is not enough and a too small attribute might be cast to a
struct ifla_vf_vlan_info, this might result in an out of bands
read access when accessing the saved (casted) entry in ivvl.

Fixes: 79aab093 ("net: Update API for VF vlan protocol 802.1ad support")
Signed-off-by: default avatarRoded Zats <rzats@paloaltonetworks.com>
Reviewed-by: default avatarDonald Hunter <donald.hunter@gmail.com>
Link: https://lore.kernel.org/r/20240502155751.75705-1-rzats@paloaltonetworks.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d0de6167
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment