• D
    rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY · 364d5716
    Daniel Borkmann 提交于
    ifla_vf_policy[] is wrong in advertising its individual member types as
    NLA_BINARY since .type = NLA_BINARY in combination with .len declares the
    len member as *max* attribute length [0, len].
    
    The issue is that when do_setvfinfo() is being called to set up a VF
    through ndo handler, we could set corrupted data if the attribute length
    is less than the size of the related structure itself.
    
    The intent is exactly the opposite, namely to make sure to pass at least
    data of minimum size of len.
    
    Fixes: ebc08a6f ("rtnetlink: Add VF config code to rtnetlink")
    Cc: Mitch Williams <mitch.a.williams@intel.com>
    Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: NThomas Graf <tgraf@suug.ch>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    364d5716
rtnetlink.c 77.6 KB