Messages in this thread Patch in this message | | | From | Lin Ma <> | Subject | [PATCH v1] ice: Add length check for IFLA_AF_SPEC parsing | Date | Sun, 23 Jul 2023 15:52:39 +0800 |
| |
The nla_for_each_nested parsing in function ice_bridge_setlink() does not check the length of the nested attribute. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as a 2 byte integer.
This patch adds the check based on nla_len() just as other code does, see how bnxt_bridge_setlink (drivers/net/ethernet/broadcom/bnxt/bnxt.c) parses IFLA_AF_SPEC: type checking plus length checking.
Fixes: b1edc14a3fbf ("ice: Implement ice_bridge_getlink and ice_bridge_setlink") Signed-off-by: Lin Ma <linma@zju.edu.cn> --- drivers/net/ethernet/intel/ice/ice_main.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c index 19a5e7f3a075..85730075dcb4 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -7701,6 +7701,10 @@ ice_bridge_setlink(struct net_device *dev, struct nlmsghdr *nlh, if (nla_type(attr) != IFLA_BRIDGE_MODE) continue; + + if (nla_len(attr) < sizeof(mode)) + return -EINVAL; + mode = nla_get_u16(attr); if (mode != BRIDGE_MODE_VEPA && mode != BRIDGE_MODE_VEB) return -EINVAL; -- 2.17.1
| |