Searched hist:"6 c58c8816abb7b93b21fa3b1d0c1726402e5e568" (Results 1 – 1 of 1) sorted by relevance
| /openbmc/linux/net/sched/ |
| H A D | sch_mqprio.c | diff 6c58c8816abb7b93b21fa3b1d0c1726402e5e568 Mon Jul 24 21:42:27 CDT 2023 Lin Ma <linma@zju.edu.cn> net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
The nla_for_each_nested parsing in function mqprio_parse_nlattr() does
not check the length of the nested attribute. This can lead to an
out-of-attribute read and allow a malformed nlattr (e.g., length 0) to
be viewed as 8 byte integer and passed to priv->max_rate/min_rate.
This patch adds the check based on nla_len() when check the nla_type(),
which ensures that the length of these two attribute must equals
sizeof(u64).
Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio")
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Link: https://lore.kernel.org/r/20230725024227.426561-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|