]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY
authorDaniel Borkmann <daniel@iogearbox.net>
Thu, 5 Feb 2015 17:44:04 +0000 (18:44 +0100)
committerJiri Slaby <jslaby@suse.cz>
Thu, 12 Mar 2015 09:06:22 +0000 (10:06 +0100)
commit8847ac8980717c27ff7cfec617be1e2261f0a25f
treeb8a46306ab400098ff942ae601777a540df14149
parent7097d6432409cef7ad4996e580eff45025183c99
rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY

[ Upstream commit 364d5716a7adb91b731a35765d369602d68d2881 ]

ifla_vf_policy[] is wrong in advertising its individual member types as
NLA_BINARY since .type = NLA_BINARY in combination with .len declares the
len member as *max* attribute length [0, len].

The issue is that when do_setvfinfo() is being called to set up a VF
through ndo handler, we could set corrupted data if the attribute length
is less than the size of the related structure itself.

The intent is exactly the opposite, namely to make sure to pass at least
data of minimum size of len.

Fixes: ebc08a6f47ee ("rtnetlink: Add VF config code to rtnetlink")
Cc: Mitch Williams <mitch.a.williams@intel.com>
Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
net/core/rtnetlink.c