Messages in this thread | | | Subject | Re: [PATCH net v3] rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length | From | patchwork-bot+netdevbpf@kernel ... | Date | Fri, 28 Jul 2023 00:20:20 +0000 |
| |
Hello:
This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>:
On Wed, 26 Jul 2023 15:53:14 +0800 you wrote: > There are totally 9 ndo_bridge_setlink handlers in the current kernel, > which are 1) bnxt_bridge_setlink, 2) be_ndo_bridge_setlink 3) > i40e_ndo_bridge_setlink 4) ice_bridge_setlink 5) > ixgbe_ndo_bridge_setlink 6) mlx5e_bridge_setlink 7) > nfp_net_bridge_setlink 8) qeth_l2_bridge_setlink 9) br_setlink. > > By investigating the code, we find that 1-7 parse and use nlattr > IFLA_BRIDGE_MODE but 3 and 4 forget to do the nla_len check. This can > lead to an out-of-attribute read and allow a malformed nlattr (e.g., > length 0) to be viewed as a 2 byte integer. > > [...]
Here is the summary with links: - [net,v3] rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length https://git.kernel.org/netdev/net/c/d73ef2d69c0d
You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
| |