netdev - [PATCH] rtnetlink: Actually use the policy for the IFLA_VF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 30 Jun 2015 16:52:55 -0600
From:	Jason Gunthorpe <jgunthorpe@...idianresearch.com>
To:	netdev@...r.kernel.org, Daniel Borkmann <daniel@...earbox.net>,
	Mitch Williams <mitch.a.williams@...el.com>,
	Jeff Kirsher <jeffrey.t.kirsher@...el.com>
Cc:	Nicolas Dichtel <nicolas.dichtel@...nd.com>,
	Jiri Pirko <jiri@...nulli.us>, Thomas Graf <tgraf@...g.ch>,
	"David S. Miller" <davem@...emloft.net>
Subject: [PATCH] rtnetlink: Actually use the policy for the IFLA_VF_INFO

It turns out the policy was defined but never actually checked,
so lets check it.

Fixes: ebc08a6f47ee ("rtnetlink: Add VF config code to rtnetlink")
Signed-off-by: Jason Gunthorpe <jgunthorpe@...idianresearch.com>
---
 net/core/rtnetlink.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

DaveM: This shouldn't be applied until someone with the hardware that
uses this can test it to make sure the policy is actually correct and
matches what iproute does..

I noticed this by inspection when investigating how to properly use
netlink in another area. Compile tested only.

Daniel/Mitch/Jeff: Can you test this?

I suspect the absence of these checks allows user space to cause a
read past the end of a buffer?

I dropped the ifla_vfinfo_policy to match how
IFLA_VF_PORTS/IFLA_VF_PORT is working but I wonder if that should be
changed as well?

Thanks,
Jason

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a2b90e1fc115..7d5dc347bf7c 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1258,10 +1258,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
 	[IFLA_INFO_SLAVE_DATA]	= { .type = NLA_NESTED },
 };
 
-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
-	[IFLA_VF_INFO]		= { .type = NLA_NESTED },
-};
-
 static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
 	[IFLA_VF_MAC]		= { .len = sizeof(struct ifla_vf_mac) },
 	[IFLA_VF_VLAN]		= { .len = sizeof(struct ifla_vf_vlan) },
@@ -1681,6 +1677,7 @@ static int do_setlink(const struct sk_buff *skb,
 	}
 
 	if (tb[IFLA_VFINFO_LIST]) {
+		struct nlattr *vf_attrs[IFLA_VF_MAX + 1];
 		struct nlattr *attr;
 		int rem;
 		nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
@@ -1688,6 +1685,10 @@ static int do_setlink(const struct sk_buff *skb,
 				err = -EINVAL;
 				goto errout;
 			}
+			err = nla_parse_nested(vf_attrs, IFLA_VF_MAX, attr,
+					       ifla_vf_policy);
+			if (err < 0)
+				goto errout;
 			err = do_setvfinfo(dev, attr);
 			if (err < 0)
 				goto errout;
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html