Commit 4760abaa authored by David S. Miller's avatar David S. Miller

Merge branch 'mpr-len-checks'

David Ahern says:

====================
net: Length checks for attributes within multipath routes

Add length checks for attributes within a multipath route (attributes
within RTA_MULTIPATH). Motivated by the syzbot report in patch 1 and
then expanded to other attributes as noted by Ido.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 74c78b42 8bda81a4
......@@ -197,6 +197,10 @@ int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining,
nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
if (nla_entype) {
if (nla_len(nla_entype) < sizeof(u16)) {
NL_SET_ERR_MSG(extack, "Invalid RTA_ENCAP_TYPE");
return -EINVAL;
}
encap_type = nla_get_u16(nla_entype);
if (lwtunnel_valid_encap_type(encap_type,
......
......@@ -662,6 +662,19 @@ static int fib_count_nexthops(struct rtnexthop *rtnh, int remaining,
return nhs;
}
static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla,
struct netlink_ext_ack *extack)
{
if (nla_len(nla) < sizeof(*gw)) {
NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY");
return -EINVAL;
}
*gw = nla_get_in_addr(nla);
return 0;
}
/* only called when fib_nh is integrated into fib_info */
static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
int remaining, struct fib_config *cfg,
......@@ -704,7 +717,11 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
return -EINVAL;
}
if (nla) {
fib_cfg.fc_gw4 = nla_get_in_addr(nla);
ret = fib_gw_from_attr(&fib_cfg.fc_gw4, nla,
extack);
if (ret)
goto errout;
if (fib_cfg.fc_gw4)
fib_cfg.fc_gw_family = AF_INET;
} else if (nlav) {
......@@ -714,10 +731,18 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
}
nla = nla_find(attrs, attrlen, RTA_FLOW);
if (nla)
if (nla) {
if (nla_len(nla) < sizeof(u32)) {
NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");
return -EINVAL;
}
fib_cfg.fc_flow = nla_get_u32(nla);
}
fib_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);
/* RTA_ENCAP_TYPE length checked in
* lwtunnel_valid_encap_type_attr
*/
nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
if (nla)
fib_cfg.fc_encap_type = nla_get_u16(nla);
......@@ -902,6 +927,7 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi,
attrlen = rtnh_attrlen(rtnh);
if (attrlen > 0) {
struct nlattr *nla, *nlav, *attrs = rtnh_attrs(rtnh);
int err;
nla = nla_find(attrs, attrlen, RTA_GATEWAY);
nlav = nla_find(attrs, attrlen, RTA_VIA);
......@@ -912,12 +938,17 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi,
}
if (nla) {
__be32 gw;
err = fib_gw_from_attr(&gw, nla, extack);
if (err)
return err;
if (nh->fib_nh_gw_family != AF_INET ||
nla_get_in_addr(nla) != nh->fib_nh_gw4)
gw != nh->fib_nh_gw4)
return 1;
} else if (nlav) {
struct fib_config cfg2;
int err;
err = fib_gw_from_via(&cfg2, nlav, extack);
if (err)
......@@ -940,8 +971,14 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi,
#ifdef CONFIG_IP_ROUTE_CLASSID
nla = nla_find(attrs, attrlen, RTA_FLOW);
if (nla && nla_get_u32(nla) != nh->nh_tclassid)
return 1;
if (nla) {
if (nla_len(nla) < sizeof(u32)) {
NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");
return -EINVAL;
}
if (nla_get_u32(nla) != nh->nh_tclassid)
return 1;
}
#endif
}
......
......@@ -5224,6 +5224,19 @@ static bool ip6_route_mpath_should_notify(const struct fib6_info *rt)
return should_notify;
}
static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla,
struct netlink_ext_ack *extack)
{
if (nla_len(nla) < sizeof(*gw)) {
NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY");
return -EINVAL;
}
*gw = nla_get_in6_addr(nla);
return 0;
}
static int ip6_route_multipath_add(struct fib6_config *cfg,
struct netlink_ext_ack *extack)
{
......@@ -5264,10 +5277,20 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
nla = nla_find(attrs, attrlen, RTA_GATEWAY);
if (nla) {
r_cfg.fc_gateway = nla_get_in6_addr(nla);
int ret;
ret = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
extack);
if (ret)
return ret;
r_cfg.fc_flags |= RTF_GATEWAY;
}
r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);
/* RTA_ENCAP_TYPE length checked in
* lwtunnel_valid_encap_type_attr
*/
nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
if (nla)
r_cfg.fc_encap_type = nla_get_u16(nla);
......@@ -5434,7 +5457,11 @@ static int ip6_route_multipath_del(struct fib6_config *cfg,
nla = nla_find(attrs, attrlen, RTA_GATEWAY);
if (nla) {
nla_memcpy(&r_cfg.fc_gateway, nla, 16);
err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
extack);
if (err)
return err;
r_cfg.fc_flags |= RTF_GATEWAY;
}
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment