forked from Minki/linux
net: Validate IFLA_BRIDGE_MODE attribute length
Payload is currently accessed blindly and may exceed valid message boundaries. Fixes:a77dcb8c8
("be2net: set and query VEB/VEPA mode of the PF interface") Fixes:815cccbf1
("ixgbe: add setlink, getlink support to ixgbe and ixgbevf") Cc: Ajit Khaparde <ajit.khaparde@emulex.com> Cc: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: Thomas Graf <tgraf@suug.ch> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Acked-by: John Fastabend <john.r.fastabend@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
6e8d1c5545
commit
b7c1a31411
@ -4314,6 +4314,9 @@ static int be_ndo_bridge_setlink(struct net_device *dev, struct nlmsghdr *nlh)
|
||||
if (nla_type(attr) != IFLA_BRIDGE_MODE)
|
||||
continue;
|
||||
|
||||
if (nla_len(attr) < sizeof(mode))
|
||||
return -EINVAL;
|
||||
|
||||
mode = nla_get_u16(attr);
|
||||
if (mode != BRIDGE_MODE_VEPA && mode != BRIDGE_MODE_VEB)
|
||||
return -EINVAL;
|
||||
|
@ -7677,6 +7677,9 @@ static int ixgbe_ndo_bridge_setlink(struct net_device *dev,
|
||||
if (nla_type(attr) != IFLA_BRIDGE_MODE)
|
||||
continue;
|
||||
|
||||
if (nla_len(attr) < sizeof(mode))
|
||||
return -EINVAL;
|
||||
|
||||
mode = nla_get_u16(attr);
|
||||
if (mode == BRIDGE_MODE_VEPA) {
|
||||
reg = 0;
|
||||
|
Loading…
Reference in New Issue
Block a user