[PATCH net] team: validate the length of U32 and S32 option data

[PATCH net] team: validate the length of U32 and S32 option data

[Wenbo Sun]

In team_nl_options_set_doit(), TEAM_ATTR_OPTION_DATA attribute policy is
NLA_BINARY in team_attr_option_nl_policy because the option data format
depends on the option type.

When setting an option of type TEAM_OPTION_TYPE_U32 or
TEAM_OPTION_TYPE_S32, ctx.data.u32_val or ctx.data.s32_val is retrieved via
nla_get_u32(attr_data) or nla_get_s32(attr_data) without validating that
the attribute payload is at least sizeof(u32) or sizeof(s32). If userspace
supplies truncated option data (e.g. 0 to 3 bytes), nla_get_u32() or
nla_get_s32() will perform an out-of-bounds read past the attribute data
buffer.

This issue was identified during a code audit of Netlink option handlers
in the team driver. The bug was confirmed and reproduced on a UML kernel:
passing truncated option data for notify_peers_count (U32) or priority
(S32) succeeded on an unpatched kernel instead of failing validation.

Add explicit length checks for TEAM_OPTION_TYPE_U32 and
TEAM_OPTION_TYPE_S32 in team_nl_options_set_doit() to reject truncated
attributes with -EINVAL, similar to commit 5bef3ac184b5 ("team: better
TEAM_OPTION_TYPE_STRING validation").

Tested:
- In UML, verified that sending truncated U32 and S32 option data (0 to 3
  bytes) is rejected with -EINVAL on a patched kernel, while valid U32 and
  S32 option settings succeed.
- Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with
  zero new warnings or errors.

Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
---
 drivers/net/team/team_core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 957cc7885d2f..617f13e1620c 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -2833,6 +2833,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
 			ctx.info = opt_inst_info;
 			switch (opt_type) {
 			case TEAM_OPTION_TYPE_U32:
+				if (nla_len(attr_data) < sizeof(u32)) {
+					err = -EINVAL;
+					goto team_put;
+				}
 				ctx.data.u32_val = nla_get_u32(attr_data);
 				break;
 			case TEAM_OPTION_TYPE_STRING:
@@ -2852,6 +2856,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
 				ctx.data.bool_val = attr_data ? true : false;
 				break;
 			case TEAM_OPTION_TYPE_S32:
+				if (nla_len(attr_data) < sizeof(s32)) {
+					err = -EINVAL;
+					goto team_put;
+				}
 				ctx.data.s32_val = nla_get_s32(attr_data);
 				break;
 			default:
-- 
2.33.0

Re: [PATCH net] team: validate the length of U32 and S32 option data

[Hangbin Liu]

Hi Wenbo,
On Wed, Nov 11, 2026 at 04:59:24PM +0800, Wenbo Sun wrote:
> In team_nl_options_set_doit(), TEAM_ATTR_OPTION_DATA attribute policy is
> NLA_BINARY in team_attr_option_nl_policy because the option data format
> depends on the option type.
> 
> When setting an option of type TEAM_OPTION_TYPE_U32 or
> TEAM_OPTION_TYPE_S32, ctx.data.u32_val or ctx.data.s32_val is retrieved via
> nla_get_u32(attr_data) or nla_get_s32(attr_data) without validating that
> the attribute payload is at least sizeof(u32) or sizeof(s32). If userspace
> supplies truncated option data (e.g. 0 to 3 bytes), nla_get_u32() or
> nla_get_s32() will perform an out-of-bounds read past the attribute data
> buffer.
> 
> This issue was identified during a code audit of Netlink option handlers
> in the team driver. The bug was confirmed and reproduced on a UML kernel:
> passing truncated option data for notify_peers_count (U32) or priority
> (S32) succeeded on an unpatched kernel instead of failing validation.
> 
> Add explicit length checks for TEAM_OPTION_TYPE_U32 and
> TEAM_OPTION_TYPE_S32 in team_nl_options_set_doit() to reject truncated
> attributes with -EINVAL, similar to commit 5bef3ac184b5 ("team: better
> TEAM_OPTION_TYPE_STRING validation").
> 
> Tested:
> - In UML, verified that sending truncated U32 and S32 option data (0 to 3
>   bytes) is rejected with -EINVAL on a patched kernel, while valid U32 and
>   S32 option settings succeed.
> - Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with
>   zero new warnings or errors.
> 
> Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
> Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
> ---
>  drivers/net/team/team_core.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
> index 957cc7885d2f..617f13e1620c 100644
> --- a/drivers/net/team/team_core.c
> +++ b/drivers/net/team/team_core.c
> @@ -2833,6 +2833,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
>  			ctx.info = opt_inst_info;
>  			switch (opt_type) {
>  			case TEAM_OPTION_TYPE_U32:
> +				if (nla_len(attr_data) < sizeof(u32)) {
> +					err = -EINVAL;
> +					goto team_put;
> +				}
>  				ctx.data.u32_val = nla_get_u32(attr_data);
>  				break;
>  			case TEAM_OPTION_TYPE_STRING:
> @@ -2852,6 +2856,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
>  				ctx.data.bool_val = attr_data ? true : false;
>  				break;
>  			case TEAM_OPTION_TYPE_S32:
> +				if (nla_len(attr_data) < sizeof(s32)) {
> +					err = -EINVAL;
> +					goto team_put;
> +				}
>  				ctx.data.s32_val = nla_get_s32(attr_data);
>  				break;
>  			default:

What if the data size larger than s32/u32? Should we check it with

  if (nla_len(attr_data) != sizeof(s32))

?

Thanks
Hangbin