Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e8d1c55 authored by Thomas Graf's avatar Thomas Graf Committed by David S. Miller
Browse files

bridge: Validate IFLA_BRIDGE_FLAGS attribute length 



Payload is currently accessed blindly and may exceed valid message
boundaries.

Fixes: 407af329 ("bridge: Add netlink interface to configure vlans on bridge ports")
Cc: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 571dcfde

net/core/rtnetlink.c

+6 −0
Original line number Diff line number Diff line
@@ -2798,6 +2798,9 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh) 
	if (br_spec) {

		nla_for_each_nested(attr, br_spec, rem) {

			if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {

				if (nla_len(attr) < sizeof(flags))

					return -EINVAL;



				have_flags = true;

				flags = nla_get_u16(attr);

				break;
@@ -2868,6 +2871,9 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) 
	if (br_spec) {

		nla_for_each_nested(attr, br_spec, rem) {

			if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {

				if (nla_len(attr) < sizeof(flags))

					return -EINVAL;



				have_flags = true;

				flags = nla_get_u16(attr);

				break;