tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

NLA_BINARY misuse bug in HSR

Removed .type field from NLA to do proper length checking.
Reported by Daniel Borkmann and Julia Lawall.

Signed-off-by: Peter Heise <peter.heise@airbus.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Peter Heise and committed by
David S. Miller f9375729 b7de529c

+3 -4
+3 -4
net/hsr/hsr_netlink.c
··· 24 24 [IFLA_HSR_SLAVE2] = { .type = NLA_U32 }, 25 25 [IFLA_HSR_MULTICAST_SPEC] = { .type = NLA_U8 }, 26 26 [IFLA_HSR_VERSION] = { .type = NLA_U8 }, 27 - [IFLA_HSR_SUPERVISION_ADDR] = { .type = NLA_BINARY, .len = ETH_ALEN }, 27 + [IFLA_HSR_SUPERVISION_ADDR] = { .len = ETH_ALEN }, 28 28 [IFLA_HSR_SEQ_NR] = { .type = NLA_U16 }, 29 29 }; 30 30 ··· 121 121 122 122 123 123 /* attribute policy */ 124 - /* NLA_BINARY missing in libnl; use NLA_UNSPEC in userspace instead. */ 125 124 static const struct nla_policy hsr_genl_policy[HSR_A_MAX + 1] = { 126 - [HSR_A_NODE_ADDR] = { .type = NLA_BINARY, .len = ETH_ALEN }, 127 - [HSR_A_NODE_ADDR_B] = { .type = NLA_BINARY, .len = ETH_ALEN }, 125 + [HSR_A_NODE_ADDR] = { .len = ETH_ALEN }, 126 + [HSR_A_NODE_ADDR_B] = { .len = ETH_ALEN }, 128 127 [HSR_A_IFINDEX] = { .type = NLA_U32 }, 129 128 [HSR_A_IF1_AGE] = { .type = NLA_U32 }, 130 129 [HSR_A_IF2_AGE] = { .type = NLA_U32 },