vxlan: use the correct nlattr array in NL_SET_ERR_MSG_ATTR (cc8e7c69) · Commits · 戴 / test

IFLA_VXLAN_* attributes are in the data array, which is correctly used when fetching the value, but not when setting the extended ack. Because IFLA_VXLAN_MAX < IFLA_MAX, we avoid out of bounds array accesses, but we don't provide a pointer to the invalid attribute to userspace. Fixes: ("vxlan: change vxlan_[config_]validate() to use netlink_ext_ack for error reporting") Fixes: ("vxlan: Allow configuration of DF behaviour") Signed-off-by:

Sabrina Dubroca <sd@queasysnail.net> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/vxlan.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -3144,7 +3144,7 @@ static int vxlan_validate(struct nlattr tb[], struct nlattr data[],
		u32 id = nla_get_u32(data[IFLA_VXLAN_ID]);

		if (id >= VXLAN_N_VID) {
		NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_ID],
		NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_ID],
		"VXLAN ID must be lower than 16777216");
		return -ERANGE;
		}
		@@ -3155,7 +3155,7 @@ static int vxlan_validate(struct nlattr tb[], struct nlattr data[],
		= nla_data(data[IFLA_VXLAN_PORT_RANGE]);

		if (ntohs(p->high) < ntohs(p->low)) {
		NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_PORT_RANGE],
		NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_PORT_RANGE],
		"Invalid source port range");
		return -EINVAL;
		}
		@@ -3165,7 +3165,7 @@ static int vxlan_validate(struct nlattr tb[], struct nlattr data[],
		enum ifla_vxlan_df df = nla_get_u8(data[IFLA_VXLAN_DF]);

		if (df < 0 \|\| df > VXLAN_DF_MAX) {
		NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_DF],
		NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_DF],
		"Invalid DF attribute");
		return -EINVAL;
		}

Admin message