From patchwork Tue Jun 30 22:52:55 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Gunthorpe X-Patchwork-Id: 489830 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id DF8751402AA for ; Wed, 1 Jul 2015 08:53:11 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=obsidianresearch.com header.i=@obsidianresearch.com header.b=j0B/HVcH; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752500AbbF3WxH (ORCPT ); Tue, 30 Jun 2015 18:53:07 -0400 Received: from quartz.orcorp.ca ([184.70.90.242]:41027 "EHLO quartz.orcorp.ca" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751136AbbF3WxE (ORCPT ); Tue, 30 Jun 2015 18:53:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=obsidianresearch.com; s=rsa1; h=Content-Type:MIME-Version:Message-ID:Subject:Cc:To:From:Date; bh=7b/xQo4G2vah/LOjgSk2+sjSrwMSYcvFzaBfKh9e1sQ=; b=j0B/HVcHTxuWab65fiWIR41aEf/O94S86vdON/B8Q2SWL06t1J8qyfZloVKKEDGS9fl3vWZMdmjzJBOE7DtQu8bOYGUkUaEBxyTMNx7dVGSqSoVTNBPYDm5IFzkfdtHUQHZd+qmtQGWXlL7D3c8/1kJfO27NxJQBkaHBqsbYCJ8=; Received: from [10.0.0.192] (helo=jggl.edm.orcorp.ca) by quartz.orcorp.ca with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84) (envelope-from ) id 1ZA4Od-0000dF-Su; Tue, 30 Jun 2015 16:52:55 -0600 Received: from jgg by jggl.edm.orcorp.ca with local (Exim 4.84) (envelope-from ) id 1ZA4Od-0006gs-Ot; Tue, 30 Jun 2015 16:52:55 -0600 Date: Tue, 30 Jun 2015 16:52:55 -0600 From: Jason Gunthorpe To: netdev@vger.kernel.org, Daniel Borkmann , Mitch Williams , Jeff Kirsher Cc: Nicolas Dichtel , Jiri Pirko , Thomas Graf , "David S. Miller" Subject: [PATCH] rtnetlink: Actually use the policy for the IFLA_VF_INFO Message-ID: <20150630225255.GA22529@obsidianresearch.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) X-Broken-Reverse-DNS: no host name found for IP address 10.0.0.192 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org It turns out the policy was defined but never actually checked, so lets check it. Fixes: ebc08a6f47ee ("rtnetlink: Add VF config code to rtnetlink") Signed-off-by: Jason Gunthorpe --- net/core/rtnetlink.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) DaveM: This shouldn't be applied until someone with the hardware that uses this can test it to make sure the policy is actually correct and matches what iproute does.. I noticed this by inspection when investigating how to properly use netlink in another area. Compile tested only. Daniel/Mitch/Jeff: Can you test this? I suspect the absence of these checks allows user space to cause a read past the end of a buffer? I dropped the ifla_vfinfo_policy to match how IFLA_VF_PORTS/IFLA_VF_PORT is working but I wonder if that should be changed as well? Thanks, Jason diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index a2b90e1fc115..7d5dc347bf7c 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -1258,10 +1258,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { [IFLA_INFO_SLAVE_DATA] = { .type = NLA_NESTED }, }; -static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { - [IFLA_VF_INFO] = { .type = NLA_NESTED }, -}; - static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, @@ -1681,6 +1677,7 @@ static int do_setlink(const struct sk_buff *skb, } if (tb[IFLA_VFINFO_LIST]) { + struct nlattr *vf_attrs[IFLA_VF_MAX + 1]; struct nlattr *attr; int rem; nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) { @@ -1688,6 +1685,10 @@ static int do_setlink(const struct sk_buff *skb, err = -EINVAL; goto errout; } + err = nla_parse_nested(vf_attrs, IFLA_VF_MAX, attr, + ifla_vf_policy); + if (err < 0) + goto errout; err = do_setvfinfo(dev, attr); if (err < 0) goto errout;