diff options
| author | Lin Ma <linma@zju.edu.cn> | 2023-07-23 16:02:05 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2023-07-25 19:48:50 -0700 |
| commit | 55cef78c244d0d076f5a75a35530ca63c92f4426 (patch) | |
| tree | a0892b0dc29b9982823b08a5c4763598b8e30035 /drivers/char | |
| parent | 284779dbf4e98753458708783af8c35630674a21 (diff) | |
| download | linux-stable-55cef78c244d0d076f5a75a35530ca63c92f4426.tar.gz linux-stable-55cef78c244d0d076f5a75a35530ca63c92f4426.tar.bz2 linux-stable-55cef78c244d0d076f5a75a35530ca63c92f4426.zip | |
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
broadcast cutoff") added one additional attribute named
IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.
However, it forgot to describe the nla_policy at macvlan_policy
(drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
can be faked as empty (0 bytes) by a malicious user, which could leads
to OOB in heap just like CVE-2023-3773.
To fix it, this commit just completes the nla_policy description for
IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
potential OOB read.
Fixes: 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230723080205.3715164-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/char')
0 files changed, 0 insertions, 0 deletions