diff options
| author | Thomas Graf <tgraf@suug.ch> | 2014-11-26 13:42:16 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-11-26 15:29:00 -0500 |
| commit | 6e8d1c55454574a22b3e8e263b1a12888909b033 (patch) | |
| tree | 91b922df0732c107d37e70509684b00bc79ea22e /net/core/rtnetlink.c | |
| parent | 571dcfde23712b92e45a126f415d9424af0c2886 (diff) | |
| download | op-kernel-dev-6e8d1c55454574a22b3e8e263b1a12888909b033.zip op-kernel-dev-6e8d1c55454574a22b3e8e263b1a12888909b033.tar.gz | |
bridge: Validate IFLA_BRIDGE_FLAGS attribute length
Payload is currently accessed blindly and may exceed valid message
boundaries.
Fixes: 407af3299 ("bridge: Add netlink interface to configure vlans on bridge ports")
Cc: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/rtnetlink.c')
| -rw-r--r-- | net/core/rtnetlink.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index a688268..5a853f8 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -2798,6 +2798,9 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh) if (br_spec) { nla_for_each_nested(attr, br_spec, rem) { if (nla_type(attr) == IFLA_BRIDGE_FLAGS) { + if (nla_len(attr) < sizeof(flags)) + return -EINVAL; + have_flags = true; flags = nla_get_u16(attr); break; @@ -2868,6 +2871,9 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) if (br_spec) { nla_for_each_nested(attr, br_spec, rem) { if (nla_type(attr) == IFLA_BRIDGE_FLAGS) { + if (nla_len(attr) < sizeof(flags)) + return -EINVAL; + have_flags = true; flags = nla_get_u16(attr); break; |
