* [PATCH net] rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS
@ 2015-07-12 22:06 Daniel Borkmann
2015-07-14 14:49 ` roopa
2015-07-15 22:54 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Daniel Borkmann @ 2015-07-12 22:06 UTC (permalink / raw)
To: davem
Cc: netdev, Daniel Borkmann, Roopa Prabhu, Scott Feldman, Jason Gunthorpe
Similarly as in commit 4f7d2cdfdde7 ("rtnetlink: verify IFLA_VF_INFO
attributes before passing them to driver"), we have a double nesting
of netlink attributes, i.e. IFLA_VF_PORTS only contains IFLA_VF_PORT
that is nested itself. While IFLA_VF_PORTS is a verified attribute
from ifla_policy[], we only check if the IFLA_VF_PORTS container has
IFLA_VF_PORT attributes and then pass the attribute's content itself
via nla_parse_nested(). It would be more correct to reject inner types
other than IFLA_VF_PORT instead of continuing parsing and also similarly
as in commit 4f7d2cdfdde7, to check for a minimum of NLA_HDRLEN.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Cc: Scott Feldman <sfeldma@gmail.com>
Cc: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
---
( This was still a follow-up I found while working on 4f7d2cdfdde7,
could also go to net-next, at your preference. )
net/core/rtnetlink.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 9e433d5..dc004b1 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1804,10 +1804,13 @@ static int do_setlink(const struct sk_buff *skb,
goto errout;
nla_for_each_nested(attr, tb[IFLA_VF_PORTS], rem) {
- if (nla_type(attr) != IFLA_VF_PORT)
- continue;
- err = nla_parse_nested(port, IFLA_PORT_MAX,
- attr, ifla_port_policy);
+ if (nla_type(attr) != IFLA_VF_PORT ||
+ nla_len(attr) < NLA_HDRLEN) {
+ err = -EINVAL;
+ goto errout;
+ }
+ err = nla_parse_nested(port, IFLA_PORT_MAX, attr,
+ ifla_port_policy);
if (err < 0)
goto errout;
if (!port[IFLA_PORT_VF]) {
--
1.9.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS
2015-07-12 22:06 [PATCH net] rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS Daniel Borkmann
@ 2015-07-14 14:49 ` roopa
2015-07-15 22:54 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: roopa @ 2015-07-14 14:49 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: davem, netdev, Scott Feldman, Jason Gunthorpe
On 7/12/15, 3:06 PM, Daniel Borkmann wrote:
> Similarly as in commit 4f7d2cdfdde7 ("rtnetlink: verify IFLA_VF_INFO
> attributes before passing them to driver"), we have a double nesting
> of netlink attributes, i.e. IFLA_VF_PORTS only contains IFLA_VF_PORT
> that is nested itself. While IFLA_VF_PORTS is a verified attribute
> from ifla_policy[], we only check if the IFLA_VF_PORTS container has
> IFLA_VF_PORT attributes and then pass the attribute's content itself
> via nla_parse_nested(). It would be more correct to reject inner types
> other than IFLA_VF_PORT instead of continuing parsing and also similarly
> as in commit 4f7d2cdfdde7, to check for a minimum of NLA_HDRLEN.
>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
> Cc: Scott Feldman <sfeldma@gmail.com>
> Cc: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
>
Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS
2015-07-12 22:06 [PATCH net] rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS Daniel Borkmann
2015-07-14 14:49 ` roopa
@ 2015-07-15 22:54 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2015-07-15 22:54 UTC (permalink / raw)
To: daniel; +Cc: netdev, roopa, sfeldma, jgunthorpe
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Mon, 13 Jul 2015 00:06:02 +0200
> Similarly as in commit 4f7d2cdfdde7 ("rtnetlink: verify IFLA_VF_INFO
> attributes before passing them to driver"), we have a double nesting
> of netlink attributes, i.e. IFLA_VF_PORTS only contains IFLA_VF_PORT
> that is nested itself. While IFLA_VF_PORTS is a verified attribute
> from ifla_policy[], we only check if the IFLA_VF_PORTS container has
> IFLA_VF_PORT attributes and then pass the attribute's content itself
> via nla_parse_nested(). It would be more correct to reject inner types
> other than IFLA_VF_PORT instead of continuing parsing and also similarly
> as in commit 4f7d2cdfdde7, to check for a minimum of NLA_HDRLEN.
>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Applied, thanks Daniel.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-07-15 22:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-07-12 22:06 [PATCH net] rtnetlink: reject non-IFLA_VF_PORT attributes inside IFLA_VF_PORTS Daniel Borkmann
2015-07-14 14:49 ` roopa
2015-07-15 22:54 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).