[PATCH net v2] team: validate the length of U32 and S32 option data

[PATCH net v2] team: validate the length of U32 and S32 option data

[Wenbo Sun]

In team_nl_options_set_doit(), the policy for TEAM_ATTR_OPTION_DATA in
team_attr_option_nl_policy is NLA_BINARY because the payload layout
varies with the option type.

For TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32, the payload is
read directly with nla_get_u32(attr_data) and nla_get_s32(attr_data)
without checking its attribute length. When userspace supplies a
truncated attribute (0 to 3 bytes), nla_get_u32() or nla_get_s32()
performs an out-of-bounds read past the attribute buffer. Conversely,
oversized payloads (> 4 bytes) would also have trailing bytes
silently ignored instead of being rejected as invalid input.

Validate that nla_len(attr_data) equals sizeof(u32) or sizeof(s32)
for TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32 respectively, and
return -EINVAL otherwise, consistent with how NLA_U32/NLA_S32
attributes are validated and similar to commit 5bef3ac184b5 ("team:
better TEAM_OPTION_TYPE_STRING validation").

This issue was identified with the assistance of an LLM-based code
review of Netlink option handlers in the team driver, confirmed by
sending malformed U32 (notify_peers_count) and S32 (priority) option
attributes on a UML kernel, and verified after the patch that
invalid lengths (0..3, 5, and 8 bytes) are rejected with -EINVAL while
valid 4-byte options still work as expected.

Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with
zero new warnings or errors.

Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
---

Changes in v2:
- Check exact length (!= sizeof(u32) / != sizeof(s32)) instead of
  only rejecting truncated payloads (<), as suggested by Hangbin Liu.
- Extended the UML test to also cover oversized option payloads.

 drivers/net/team/team_core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
index 957cc7885d2f..8fa05c489b99 100644
--- a/drivers/net/team/team_core.c
+++ b/drivers/net/team/team_core.c
@@ -2833,6 +2833,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
 			ctx.info = opt_inst_info;
 			switch (opt_type) {
 			case TEAM_OPTION_TYPE_U32:
+				if (nla_len(attr_data) != sizeof(u32)) {
+					err = -EINVAL;
+					goto team_put;
+				}
 				ctx.data.u32_val = nla_get_u32(attr_data);
 				break;
 			case TEAM_OPTION_TYPE_STRING:
@@ -2852,6 +2856,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
 				ctx.data.bool_val = attr_data ? true : false;
 				break;
 			case TEAM_OPTION_TYPE_S32:
+				if (nla_len(attr_data) != sizeof(s32)) {
+					err = -EINVAL;
+					goto team_put;
+				}
 				ctx.data.s32_val = nla_get_s32(attr_data);
 				break;
 			default:
-- 
2.33.0

Re: [PATCH net v2] team: validate the length of U32 and S32 option data

[Hangbin Liu]

On Thu, Nov 12, 2026 at 05:00:30PM +0800, Wenbo Sun wrote:
> In team_nl_options_set_doit(), the policy for TEAM_ATTR_OPTION_DATA in
> team_attr_option_nl_policy is NLA_BINARY because the payload layout
> varies with the option type.
> 
> For TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32, the payload is
> read directly with nla_get_u32(attr_data) and nla_get_s32(attr_data)
> without checking its attribute length. When userspace supplies a
> truncated attribute (0 to 3 bytes), nla_get_u32() or nla_get_s32()
> performs an out-of-bounds read past the attribute buffer. Conversely,
> oversized payloads (> 4 bytes) would also have trailing bytes
> silently ignored instead of being rejected as invalid input.
> 
> Validate that nla_len(attr_data) equals sizeof(u32) or sizeof(s32)
> for TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32 respectively, and
> return -EINVAL otherwise, consistent with how NLA_U32/NLA_S32
> attributes are validated and similar to commit 5bef3ac184b5 ("team:
> better TEAM_OPTION_TYPE_STRING validation").
> 
> This issue was identified with the assistance of an LLM-based code
> review of Netlink option handlers in the team driver, confirmed by
> sending malformed U32 (notify_peers_count) and S32 (priority) option
> attributes on a UML kernel, and verified after the patch that
> invalid lengths (0..3, 5, and 8 bytes) are rejected with -EINVAL while
> valid 4-byte options still work as expected.
> 
> Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with
> zero new warnings or errors.
> 
> Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
> Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>
> ---
> 
> Changes in v2:
> - Check exact length (!= sizeof(u32) / != sizeof(s32)) instead of
>   only rejecting truncated payloads (<), as suggested by Hangbin Liu.
> - Extended the UML test to also cover oversized option payloads.
> 
>  drivers/net/team/team_core.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c
> index 957cc7885d2f..8fa05c489b99 100644
> --- a/drivers/net/team/team_core.c
> +++ b/drivers/net/team/team_core.c
> @@ -2833,6 +2833,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
>  			ctx.info = opt_inst_info;
>  			switch (opt_type) {
>  			case TEAM_OPTION_TYPE_U32:
> +				if (nla_len(attr_data) != sizeof(u32)) {
> +					err = -EINVAL;
> +					goto team_put;
> +				}
>  				ctx.data.u32_val = nla_get_u32(attr_data);
>  				break;
>  			case TEAM_OPTION_TYPE_STRING:
> @@ -2852,6 +2856,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info)
>  				ctx.data.bool_val = attr_data ? true : false;
>  				break;
>  			case TEAM_OPTION_TYPE_S32:
> +				if (nla_len(attr_data) != sizeof(s32)) {
> +					err = -EINVAL;
> +					goto team_put;
> +				}

This part should be

Fixes: 69821638b274 ("team: add signed 32-bit team option type")

Thanks
Hangbin