lkml.org 
[lkml]   [2023]   [Jul]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v1] net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
Date
The nla_for_each_nested parsing in function mqprio_parse_nlattr() does
not check the length of the nested attribute. This can lead to an
out-of-attribute read and allow a malformed nlattr (e.g., length 0) to
be viewed as 8 byte integer and passed to priv->max_rate/min_rate.

This patch adds the check based on nla_len() when check the nla_type(),
which ensures that the attribute has enough length.

Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
---
net/sched/sch_mqprio.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index ab69ff7577fc..7bd1d261d8e7 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -285,7 +285,8 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,
i = 0;
nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64],
rem) {
- if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) {
+ if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64 ||
+ nla_len(attr) < sizeof(u64)) {
NL_SET_ERR_MSG_ATTR(extack, attr,
"Attribute type expected to be TCA_MQPRIO_MIN_RATE64");
return -EINVAL;
@@ -307,7 +308,8 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,
i = 0;
nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64],
rem) {
- if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) {
+ if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64 ||
+ nla_len(attr) < sizeof(u64)) {
NL_SET_ERR_MSG_ATTR(extack, attr,
"Attribute type expected to be TCA_MQPRIO_MAX_RATE64");
return -EINVAL;
--
2.17.1
\
 
 \ /
  Last update: 2023-07-23 09:57    [W:0.025 / U:0.012 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site