rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY
authorDaniel Borkmann <daniel@iogearbox.net>
Thu, 5 Feb 2015 17:44:04 +0000 (18:44 +0100)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 9 May 2015 22:16:15 +0000 (23:16 +0100)
commit25595132ea9d84a828f228aec150c65d4cf6816d
treefd746f177c510914c403d6d8ff4b12266847e7f8
parent8bcd2a0924ca7c226d254fa45c75c6882b60af2d
rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY

commit 364d5716a7adb91b731a35765d369602d68d2881 upstream.

ifla_vf_policy[] is wrong in advertising its individual member types as
NLA_BINARY since .type = NLA_BINARY in combination with .len declares the
len member as *max* attribute length [0, len].

The issue is that when do_setvfinfo() is being called to set up a VF
through ndo handler, we could set corrupted data if the attribute length
is less than the size of the related structure itself.

The intent is exactly the opposite, namely to make sure to pass at least
data of minimum size of len.

Fixes: ebc08a6f47ee ("rtnetlink: Add VF config code to rtnetlink")
Cc: Mitch Williams <mitch.a.williams@intel.com>
Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: drop the unsupported attributes]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
net/core/rtnetlink.c