Linux 5.10.217

[thirdparty/kernel/stable-queue.git] / queue-5.10 / rtnetlink-correct-nested-ifla_vf_vlan_list-attribute.patch

diff --git a/queue-5.10/rtnetlink-correct-nested-ifla_vf_vlan_list-attribute.patch b/queue-5.10/rtnetlink-correct-nested-ifla_vf_vlan_list-attribute.patch
deleted file mode 100644 (file)
index 2730d20..0000000
--- a/queue-5.10/rtnetlink-correct-nested-ifla_vf_vlan_list-attribute.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 6f66058fdaea6899c3348877ca6e703fb006bd92 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 2 May 2024 18:57:51 +0300
-Subject: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
-
-From: Roded Zats <rzats@paloaltonetworks.com>
-
-[ Upstream commit 1aec77b2bb2ed1db0f5efc61c4c1ca3813307489 ]
-
-Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
-struct ifla_vf_vlan_info so the size of such attribute needs to be at least
-of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
-The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
-which is less than sizeof(struct ifla_vf_vlan_info) so this validation
-is not enough and a too small attribute might be cast to a
-struct ifla_vf_vlan_info, this might result in an out of bands
-read access when accessing the saved (casted) entry in ivvl.
-
-Fixes: 79aab093a0b5 ("net: Update API for VF vlan protocol 802.1ad support")
-Signed-off-by: Roded Zats <rzats@paloaltonetworks.com>
-Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
-Link: https://lore.kernel.org/r/20240502155751.75705-1-rzats@paloaltonetworks.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- net/core/rtnetlink.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 8938320f7ba3b..2806b9ed63879 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -2379,7 +2379,7 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
- 
-               nla_for_each_nested(attr, tb[IFLA_VF_VLAN_LIST], rem) {
-                       if (nla_type(attr) != IFLA_VF_VLAN_INFO ||
--                          nla_len(attr) < NLA_HDRLEN) {
-+                          nla_len(attr) < sizeof(struct ifla_vf_vlan_info)) {
-                               return -EINVAL;
-                       }
-                       if (len >= MAX_VLAN_LIST_LEN)
--- 
-2.43.0
-