diff mbox series

[5.5,047/151] devlink: validate length of region addr/len

Message ID	20200317103329.941073777@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=f8y2=5C=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Jakub Kicinski <kuba@kernel.org>, Jiri Pirko <jiri@mellanox.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 5.5 047/151] devlink: validate length of region addr/len Date: Tue, 17 Mar 2020 11:54:17 +0100 Message-Id: <20200317103329.941073777@linuxfoundation.org> In-Reply-To: <20200317103326.593639086@linuxfoundation.org> References: <20200317103326.593639086@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.5,003/151] ALSA: hda/realtek - Add Headset Mic supported for HP cPC [5.5,005/151] cgroup, netclassid: periodically release file_lock on classid updating [5.5,008/151] inet_diag: return classid for all socket types [5.5,009/151] ipv6/addrconf: call ipv6_mc_up() for non-Ethernet interface [5.5,010/151] ipvlan: add cond_resched_rcu() while processing muticast backlog [5.5,012/151] ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast() [5.5,013/151] ipvlan: dont deref eth hdr before checking its set [5.5,019/151] net/ipv6: use configured metric when add peer route [5.5,021/151] net: macsec: update SCI upon MAC address change. [5.5,025/151] net: phy: bcm63xx: fix OOPS due to missing driver name [5.5,026/151] net/smc: cancel event worker during device removal [5.5,028/151] net: systemport: fix index check to avoid an array out of bounds access [5.5,030/151] sfc: detach from cb_page in efx_copy_channel() [5.5,032/151] taprio: Fix sending packets without dequeueing them [5.5,034/151] bnxt_en: reinitialize IRQs when MTU is modified [5.5,036/151] cgroup: memcg: net: do not associate sock with unrelated cgroup [5.5,038/151] net: memcg: fix lockdep splat in inet_csk_accept() [5.5,041/151] fsl/fman: detect FMan erratum A050385 [5.5,042/151] dpaa_eth: FMan erratum A050385 workaround [5.5,043/151] net: hns3: fix "tc qdisc del" failed issue [5.5,045/151] net: hns3: clear port base VLAN when unload PF [5.5,047/151] devlink: validate length of region addr/len [5.5,050/151] nl802154: add missing attribute validation for dev_type [5.5,051/151] can: add missing attribute validation for termination [5.5,053/151] openvswitch: add missing attribute validation for hash [5.5,056/151] team: add missing attribute validation for port ifindex [5.5,057/151] team: add missing attribute validation for array index [5.5,059/151] nfc: add missing attribute validation for SE API [5.5,062/151] net: phy: avoid clearing PHY interrupts twice in irq handler [5.5,063/151] net: phy: fix MDIO bus PM PHY resuming [5.5,064/151] net/ipv6: need update peer route when modify metric [5.5,066/151] selftests/net/fib_tests: update addr_metric_test for peer route testing [5.5,068/151] s390/qeth: handle error when backing RX buffer [5.5,069/151] net: dsa: Dont instantiate phylink for CPU/DSA ports unless needed [5.5,071/151] net: phy: Avoid multiple suspends [5.5,073/151] cgroup: cgroup_procs_next should increase position index [5.5,076/151] iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices [5.5,079/151] netfilter: nf_conntrack: ct_cpu_seq_next should increase position index [5.5,080/151] netfilter: synproxy: synproxy_cpu_seq_next should increase position index [5.5,082/151] netfilter: x_tables: xt_mttg_seq_next should increase position index [5.5,086/151] drm/i915: Return early for await_start on same timeline [5.5,087/151] drm/i915: be more solid in checking the alignment [5.5,088/151] drm/i915: Defer semaphore priority bumping to a workqueue [5.5,090/151] drm/i915/execlists: Enable timeslice on partial virtual engine dequeue [5.5,092/151] pinctrl: falcon: fix syntax error [5.5,093/151] pinctrl: qcom: Assign irq_eoi conditionally [5.5,096/151] cifs_atomic_open(): fix double-put on late allocation failure [5.5,098/151] KVM: x86: clear stale x86_emulate_ctxt->intercept value [5.5,100/151] ARC: define __ALIGN_STR and __ALIGN symbols for ARC [5.5,101/151] fuse: fix stack use after return [5.5,103/151] MIPS: DTS: CI20: fix interrupt for pcf8563 RTC [5.5,105/151] s390/dasd: fix data corruption for thin provisioned devices [5.5,106/151] ipmi_si: Avoid spurious errors for optional IRQs [5.5,109/151] fscrypt: dont evict dirty inodes after removing key [5.5,110/151] pid: Fix error return value in some cases [5.5,112/151] x86/ioremap: Map EFI runtime services data as encrypted for SEV [5.5,114/151] efi: Add a sanity check to efivar_store_raw() [5.5,116/151] mt76: fix array overflow on receiving too many fragments for a packet [5.5,117/151] perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag [5.5,120/151] iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint [5.5,122/151] iommu/vt-d: Fix RCU list debugging warnings [5.5,126/151] pinctrl: meson-gxl: fix GPIOX sdio pins [5.5,127/151] pinctrl: imx: scu: Align imx sc msg structs to 4 [5.5,128/151] virtio_ring: Fix mem leak with vring_new_virtqueue() [5.5,131/151] pinctrl: core: Remove extra kref_get which blocks hogs being freed [5.5,133/151] driver code: clarify and fix platform device DMA mask allocation [5.5,135/151] i2c: gpio: suppress error on probe defer [5.5,137/151] nl80211: add missing attribute validation for beacon report scanning [5.5,139/151] perf bench futex-wake: Restore thread count default to online CPU count [5.5,141/151] netfilter: cthelper: add missing attribute validation for cthelper [5.5,144/151] netfilter: nf_tables: dump NFTA_CHAIN_FLAGS attribute [5.5,145/151] netfilter: nft_chain_nat: inet family is missing module ownership [5.5,147/151] iommu/vt-d: Ignore devices with out-of-spec domain number [5.5,149/151] iommu/amd: Fix IOMMU AVIC not properly update the is_run bit in IRTE

Commit Message

Greg KH March 17, 2020, 10:54 a.m. UTC

From: Jakub Kicinski <kuba@kernel.org>

[ Upstream commit ff3b63b8c299b73ac599b120653b47e275407656 ]

DEVLINK_ATTR_REGION_CHUNK_ADDR and DEVLINK_ATTR_REGION_CHUNK_LEN
lack entries in the netlink policy. Corresponding nla_get_u64()s
may read beyond the end of the message.

Fixes: 4e54795a27f5 ("devlink: Add support for region snapshot read command")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/devlink.c |    2 ++
 1 file changed, 2 insertions(+)

diff mbox series

Patch

--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -5924,6 +5924,8 @@  static const struct nla_policy devlink_n
 	[DEVLINK_ATTR_PARAM_VALUE_CMODE] = { .type = NLA_U8 },
 	[DEVLINK_ATTR_REGION_NAME] = { .type = NLA_NUL_STRING },
 	[DEVLINK_ATTR_REGION_SNAPSHOT_ID] = { .type = NLA_U32 },
+	[DEVLINK_ATTR_REGION_CHUNK_ADDR] = { .type = NLA_U64 },
+	[DEVLINK_ATTR_REGION_CHUNK_LEN] = { .type = NLA_U64 },
 	[DEVLINK_ATTR_HEALTH_REPORTER_NAME] = { .type = NLA_NUL_STRING },
 	[DEVLINK_ATTR_HEALTH_REPORTER_GRACEFUL_PERIOD] = { .type = NLA_U64 },
 	[DEVLINK_ATTR_HEALTH_REPORTER_AUTO_RECOVER] = { .type = NLA_U8 },