From: Stephen Hemminger <stephen@networkplumber•org>
To: davem@davemloft•net
Cc: netdev@vger•kernel.org, Stephen Hemminger <sthemmin@microsoft•com>
Subject: [PATCH net-next 4/7] dcb: validate netlink attribute link
Date: Tue, 10 Jan 2017 10:18:13 -0800 [thread overview]
Message-ID: <20170110181816.18991-5-sthemmin@microsoft.com> (raw)
In-Reply-To: <20170110181816.18991-1-sthemmin@microsoft.com>
The dcb netlink code was not validating that the IEEE_APP netlink
element was correctly formed. Initially discovered because of the
warning ‘dcbnl_ieee_app’ defined but not used.
This indicated that the message was not being fully validated.
Compile tested only. Do not have DCB setup.
Signed-off-by: Stephen Hemminger <sthemmin@microsoft•com>
---
net/dcb/dcbnl.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 3202d75329b5..52f0f2fc0a51 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -178,10 +178,6 @@ static const struct nla_policy dcbnl_ieee_policy[DCB_ATTR_IEEE_MAX + 1] = {
[DCB_ATTR_IEEE_QCN_STATS] = {.len = sizeof(struct ieee_qcn_stats)},
};
-static const struct nla_policy dcbnl_ieee_app[DCB_ATTR_IEEE_APP_MAX + 1] = {
- [DCB_ATTR_IEEE_APP] = {.len = sizeof(struct dcb_app)},
-};
-
/* DCB number of traffic classes nested attributes. */
static const struct nla_policy dcbnl_featcfg_nest[DCB_FEATCFG_ATTR_MAX + 1] = {
[DCB_FEATCFG_ATTR_ALL] = {.type = NLA_FLAG},
@@ -1466,8 +1462,15 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlmsghdr *nlh,
nla_for_each_nested(attr, ieee[DCB_ATTR_IEEE_APP_TABLE], rem) {
struct dcb_app *app_data;
+
if (nla_type(attr) != DCB_ATTR_IEEE_APP)
continue;
+
+ if (nla_len(attr) != sizeof(struct dcb_app)) {
+ err = -ERANGE;
+ goto err;
+ }
+
app_data = nla_data(attr);
if (ops->ieee_setapp)
err = ops->ieee_setapp(netdev, app_data);
--
2.11.0
next prev parent reply other threads:[~2017-01-10 18:18 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-10 18:18 [PATCH net-next 0/7] warning related fixes Stephen Hemminger
2017-01-10 18:18 ` [PATCH net-next 1/7] flow_dissector: make local function static Stephen Hemminger
2017-01-10 18:32 ` David Miller
2017-01-10 18:43 ` Stephen Hemminger
2017-01-10 18:18 ` [PATCH net-next 2/7] vxlan: remove unused variable Stephen Hemminger
2017-01-10 18:18 ` [PATCH net-next 3/7] socket: make sockfs_setattr static Stephen Hemminger
2017-01-10 18:18 ` Stephen Hemminger [this message]
2017-01-10 18:18 ` [PATCH net-next 5/7] tcp_nv: make tcpnv_get_info static Stephen Hemminger
2017-01-10 19:50 ` Lawrence Brakmo
2017-01-10 18:18 ` [PATCH net-next 6/7] ipv6: make udpv6_queue_rcv_skb static Stephen Hemminger
2017-01-10 18:18 ` [PATCH net-next 7/7] fq_codel: fix set never used warning Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170110181816.18991-5-sthemmin@microsoft.com \
--to=stephen@networkplumber$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=sthemmin@microsoft$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox