From: Hagen Paul Pfeifer <hagen@jauu.net>
Date: Wed, 15 Feb 2012 04:09:46 +0000 (+0000)
Subject: veth: Enforce minimum size of VETH_INFO_PEER
X-Git-Tag: v3.2.9~49
X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b21abc775d2095a517f74f6df989569e3131e9c7;p=pandora-kernel.git

veth: Enforce minimum size of VETH_INFO_PEER

[ Upstream commit 237114384ab22c174ec4641e809f8e6cbcfce774 ]

VETH_INFO_PEER carries struct ifinfomsg plus optional IFLA
attributes. A minimal size of sizeof(struct ifinfomsg) must be
enforced or we may risk accessing that struct beyond the limits
of the netlink message.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index ef883e97cee0..b90739831430 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -423,7 +423,9 @@ static void veth_dellink(struct net_device *dev, struct list_head *head)
 	unregister_netdevice_queue(peer, head);
 }
 
-static const struct nla_policy veth_policy[VETH_INFO_MAX + 1];
+static const struct nla_policy veth_policy[VETH_INFO_MAX + 1] = {
+	[VETH_INFO_PEER]	= { .len = sizeof(struct ifinfomsg) },
+};
 
 static struct rtnl_link_ops veth_link_ops = {
 	.kind		= DRV_NAME,