Commit a3e948e8 authored Dec 10, 2015 by Robert Shearman Committed by David S. Miller Dec 12, 2015

mpls: validate L2 via address length



If an L2 via address for an mpls nexthop is specified, the length of
the L2 address must match that expected by the output device,
otherwise it could access memory beyond the end of the via address
buffer in the route.

This check was present prior to commit f8efb73c ("mpls: multipath
route support"), but got lost in the refactoring, so add it back,
applying it to all nexthops in multipath routes.

Fixes: f8efb73c ("mpls: multipath route support")
Signed-off-by: Robert Shearman <rshearma@brocade.com>
Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f1c2ef40

net/mpls/af_mpls.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -534,6 +534,10 @@ static int mpls_nh_assign_dev(struct net net, struct mpls_route rt,
		if (!mpls_dev_get(dev))
		goto errout;

		if ((nh->nh_via_table == NEIGH_LINK_TABLE) &&
		(dev->addr_len != nh->nh_via_alen))
		goto errout;

		RCU_INIT_POINTER(nh->nh_dev, dev);

		return 0;

Admin message