Commit 035d210f authored by Daniel Borkmann's avatar Daniel Borkmann Committed by David S. Miller

rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS

Similarly as in commit 4f7d2cdf ("rtnetlink: verify IFLA_VF_INFO
attributes before passing them to driver"), we have a double nesting
of netlink attributes, i.e. IFLA_VF_PORTS only contains IFLA_VF_PORT
that is nested itself. While IFLA_VF_PORTS is a verified attribute
from ifla_policy[], we only check if the IFLA_VF_PORTS container has
IFLA_VF_PORT attributes and then pass the attribute's content itself
via nla_parse_nested(). It would be more correct to reject inner types
other than IFLA_VF_PORT instead of continuing parsing and also similarly
as in commit 4f7d2cdf, to check for a minimum of NLA_HDRLEN.
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Cc: Scott Feldman <sfeldma@gmail.com>
Cc: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Acked-by: default avatarRoopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 50c2e4dd
...@@ -1804,10 +1804,13 @@ static int do_setlink(const struct sk_buff *skb, ...@@ -1804,10 +1804,13 @@ static int do_setlink(const struct sk_buff *skb,
goto errout; goto errout;
nla_for_each_nested(attr, tb[IFLA_VF_PORTS], rem) { nla_for_each_nested(attr, tb[IFLA_VF_PORTS], rem) {
if (nla_type(attr) != IFLA_VF_PORT) if (nla_type(attr) != IFLA_VF_PORT ||
continue; nla_len(attr) < NLA_HDRLEN) {
err = nla_parse_nested(port, IFLA_PORT_MAX, err = -EINVAL;
attr, ifla_port_policy); goto errout;
}
err = nla_parse_nested(port, IFLA_PORT_MAX, attr,
ifla_port_policy);
if (err < 0) if (err < 0)
goto errout; goto errout;
if (!port[IFLA_PORT_VF]) { if (!port[IFLA_PORT_VF]) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment