@@ -1258,10 +1258,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
[IFLA_INFO_SLAVE_DATA] = { .type = NLA_NESTED },
};
-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
- [IFLA_VF_INFO] = { .type = NLA_NESTED },
-};
-
static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
[IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) },
[IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) },
@@ -1681,6 +1677,7 @@ static int do_setlink(const struct sk_buff *skb,
}
if (tb[IFLA_VFINFO_LIST]) {
+ struct nlattr *vf_attrs[IFLA_VF_MAX + 1];
struct nlattr *attr;
int rem;
nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
@@ -1688,6 +1685,10 @@ static int do_setlink(const struct sk_buff *skb,
err = -EINVAL;
goto errout;
}
+ err = nla_parse_nested(vf_attrs, IFLA_VF_MAX, attr,
+ ifla_vf_policy);
+ if (err < 0)
+ goto errout;
err = do_setvfinfo(dev, attr);
if (err < 0)
goto errout;
It turns out the policy was defined but never actually checked, so lets check it. Fixes: ebc08a6f47ee ("rtnetlink: Add VF config code to rtnetlink") Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com> --- net/core/rtnetlink.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) DaveM: This shouldn't be applied until someone with the hardware that uses this can test it to make sure the policy is actually correct and matches what iproute does.. I noticed this by inspection when investigating how to properly use netlink in another area. Compile tested only. Daniel/Mitch/Jeff: Can you test this? I suspect the absence of these checks allows user space to cause a read past the end of a buffer? I dropped the ifla_vfinfo_policy to match how IFLA_VF_PORTS/IFLA_VF_PORT is working but I wonder if that should be changed as well? Thanks, Jason