macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF
authorLin Ma <linma@zju.edu.cn>
Sun, 23 Jul 2023 08:02:05 +0000 (16:02 +0800)
committerJakub Kicinski <kuba@kernel.org>
Wed, 26 Jul 2023 02:48:50 +0000 (19:48 -0700)
commit55cef78c244d0d076f5a75a35530ca63c92f4426
treea0892b0dc29b9982823b08a5c4763598b8e30035
parent284779dbf4e98753458708783af8c35630674a21
macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF

The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
broadcast cutoff") added one additional attribute named
IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.

However, it forgot to describe the nla_policy at macvlan_policy
(drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
can be faked as empty (0 bytes) by a malicious user, which could leads
to OOB in heap just like CVE-2023-3773.

To fix it, this commit just completes the nla_policy description for
IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
potential OOB read.

Fixes: 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230723080205.3715164-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/macvlan.c