diff options
| author | Lin Ma <[email protected]> | 2023-07-25 02:42:27 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2023-07-27 05:08:14 +0000 |
| commit | 6c58c8816abb7b93b21fa3b1d0c1726402e5e568 (patch) | |
| tree | 85750ad130476c432682926965b10b9b7e4738db /net/tipc/node.c | |
| parent | splice, net: Fix splice_to_socket() for O_NONBLOCK socket (diff) | |
| download | kernel-6c58c8816abb7b93b21fa3b1d0c1726402e5e568.tar.gz kernel-6c58c8816abb7b93b21fa3b1d0c1726402e5e568.zip | |
net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
The nla_for_each_nested parsing in function mqprio_parse_nlattr() does
not check the length of the nested attribute. This can lead to an
out-of-attribute read and allow a malformed nlattr (e.g., length 0) to
be viewed as 8 byte integer and passed to priv->max_rate/min_rate.
This patch adds the check based on nla_len() when check the nla_type(),
which ensures that the length of these two attribute must equals
sizeof(u64).
Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio")
Reviewed-by: Victor Nogueira <[email protected]>
Signed-off-by: Lin Ma <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/tipc/node.c')
0 files changed, 0 insertions, 0 deletions