[PATCH net] rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

[PATCH net] rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

[Roded Zats]

Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
struct ifla_vf_vlan_info so the size of such attribute needs to be at least
of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
which is less than sizeof(struct ifla_vf_vlan_info) so this validation
is not enough and a too small attribute might be cast to a
struct ifla_vf_vlan_info, this might result in an out of bands
read access when accessing the saved (casted) entry in ivvl.

Fixes: 79aab093a0b5 ("net: Update API for VF vlan protocol 802.1ad support")
Signed-off-by: Roded Zats <rzats@paloaltonetworks.com>
---
 net/core/rtnetlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a3d7847ce69d..8ba6a4e4be26 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2530,7 +2530,7 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 
 		nla_for_each_nested(attr, tb[IFLA_VF_VLAN_LIST], rem) {
 			if (nla_type(attr) != IFLA_VF_VLAN_INFO ||
-			    nla_len(attr) < NLA_HDRLEN) {
+			    nla_len(attr) < sizeof(struct ifla_vf_vlan_info)) {
 				return -EINVAL;
 			}
 			if (len >= MAX_VLAN_LIST_LEN)
-- 
2.39.3 (Apple Git-146)

Re: [PATCH net] rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

[Donald Hunter]

Roded Zats <rzats@paloaltonetworks.com> writes:

> Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
> struct ifla_vf_vlan_info so the size of such attribute needs to be at least
> of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
> The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
> which is less than sizeof(struct ifla_vf_vlan_info) so this validation
> is not enough and a too small attribute might be cast to a
> struct ifla_vf_vlan_info, this might result in an out of bands
> read access when accessing the saved (casted) entry in ivvl.
>
> Fixes: 79aab093a0b5 ("net: Update API for VF vlan protocol 802.1ad support")
> Signed-off-by: Roded Zats <rzats@paloaltonetworks.com>

Reviewed-by: Donald Hunter <donald.hunter@gmail.com>

Re: [PATCH net] rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu,  2 May 2024 18:57:51 +0300 you wrote:
> Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
> struct ifla_vf_vlan_info so the size of such attribute needs to be at least
> of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
> The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
> which is less than sizeof(struct ifla_vf_vlan_info) so this validation
> is not enough and a too small attribute might be cast to a
> struct ifla_vf_vlan_info, this might result in an out of bands
> read access when accessing the saved (casted) entry in ivvl.
> 
> [...]

Here is the summary with links:
  - [net] rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    https://git.kernel.org/netdev/net/c/1aec77b2bb2e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html