[RTNL]: Validate hardware and broadcast address attribute for RTM_NEWLINK (1840bb13) · Commits · 戴 / test

RTM_NEWLINK allows for already existing links to be modified. For this purpose do_setlink() is called which expects address attributes with a payload length of at least dev->addr_len. This patch adds the necessary validation for the RTM_NEWLINK case. The address length for links to be created is not checked for now as the actual attribute length is used when copying the address to the netdevice structure. It might make sense to report an error if less than addr_len bytes are provided but enforcing this might break drivers trying to be smart with not transmitting all zero addresses. Signed-off-by:

Thomas Graf <tgraf@suug.ch> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/core/rtnetlink.c

+19 −6

Original line number	Diff line number	Diff line
		@@ -722,6 +722,21 @@ static struct net *get_net_ns_by_pid(pid_t pid)
		return net;
		}

		static int validate_linkmsg(struct net_device dev, struct nlattr tb[])
		{
		if (dev) {
		if (tb[IFLA_ADDRESS] &&
		nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
		return -EINVAL;

		if (tb[IFLA_BROADCAST] &&
		nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
		return -EINVAL;
		}

		return 0;
		}

		static int do_setlink(struct net_device dev, struct ifinfomsg ifm,
		struct nlattr *tb, char ifname, int modified)
		{
		@@ -894,12 +909,7 @@ static int rtnl_setlink(struct sk_buff skb, struct nlmsghdr nlh, void *arg)
		goto errout;
		}

		if (tb[IFLA_ADDRESS] &&
		nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
		goto errout_dev;

		if (tb[IFLA_BROADCAST] &&
		nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
		if ((err = validate_linkmsg(dev, tb)) < 0)
		goto errout_dev;

		err = do_setlink(dev, ifm, tb, ifname, 0);
		@@ -1020,6 +1030,9 @@ replay:
		else
		dev = NULL;

		if ((err = validate_linkmsg(dev, tb)) < 0)
		return err;

		if (tb[IFLA_LINKINFO]) {
		err = nla_parse_nested(linkinfo, IFLA_INFO_MAX,
		tb[IFLA_LINKINFO], ifla_info_policy);

Admin message