summaryrefslogtreecommitdiffstats
path: root/net/hsr
diff options
context:
space:
mode:
authorPeter Heise <mail@pheise.de>2016-04-19 13:34:28 +0200
committerDavid S. Miller <davem@davemloft.net>2016-04-21 13:59:08 -0400
commitf937572925d8d7beb5aca1cf180e8b9af623a903 (patch)
tree8b5f6cd9364293cb2640e4c6bc5e650c81897388 /net/hsr
parentb7de529c793c9131e58ddca37d49fd26866aa867 (diff)
downloadlinux-f937572925d8d7beb5aca1cf180e8b9af623a903.tar.gz
linux-f937572925d8d7beb5aca1cf180e8b9af623a903.tar.bz2
linux-f937572925d8d7beb5aca1cf180e8b9af623a903.zip
NLA_BINARY misuse bug in HSR
Removed .type field from NLA to do proper length checking. Reported by Daniel Borkmann and Julia Lawall. Signed-off-by: Peter Heise <peter.heise@airbus.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/hsr')
-rw-r--r--net/hsr/hsr_netlink.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 5425d87611fc..d4d1617f43a8 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -24,7 +24,7 @@ static const struct nla_policy hsr_policy[IFLA_HSR_MAX + 1] = {
[IFLA_HSR_SLAVE2] = { .type = NLA_U32 },
[IFLA_HSR_MULTICAST_SPEC] = { .type = NLA_U8 },
[IFLA_HSR_VERSION] = { .type = NLA_U8 },
- [IFLA_HSR_SUPERVISION_ADDR] = { .type = NLA_BINARY, .len = ETH_ALEN },
+ [IFLA_HSR_SUPERVISION_ADDR] = { .len = ETH_ALEN },
[IFLA_HSR_SEQ_NR] = { .type = NLA_U16 },
};
@@ -121,10 +121,9 @@ static struct rtnl_link_ops hsr_link_ops __read_mostly = {
/* attribute policy */
-/* NLA_BINARY missing in libnl; use NLA_UNSPEC in userspace instead. */
static const struct nla_policy hsr_genl_policy[HSR_A_MAX + 1] = {
- [HSR_A_NODE_ADDR] = { .type = NLA_BINARY, .len = ETH_ALEN },
- [HSR_A_NODE_ADDR_B] = { .type = NLA_BINARY, .len = ETH_ALEN },
+ [HSR_A_NODE_ADDR] = { .len = ETH_ALEN },
+ [HSR_A_NODE_ADDR_B] = { .len = ETH_ALEN },
[HSR_A_IFINDEX] = { .type = NLA_U32 },
[HSR_A_IF1_AGE] = { .type = NLA_U32 },
[HSR_A_IF2_AGE] = { .type = NLA_U32 },