vxlan: fix incorrect nlattr access in MTU check
authorMatthias Schiffer <mschiffer@universe-factory.net>
Tue, 27 Jun 2017 12:42:43 +0000 (14:42 +0200)
committerDavid S. Miller <davem@davemloft.net>
Tue, 27 Jun 2017 18:40:35 +0000 (14:40 -0400)
The access to the wrong variable could lead to a NULL dereference and
possibly other invalid memory reads in vxlan newlink/changelink requests
with a IFLA_MTU attribute.

Fixes: a985343ba906 "vxlan: refactor verification and application of configuration"
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/vxlan.c

index 0dafd8e6c6658820c8be6b16cbf75283805898d4..fd0ff97e3d81f3c4249c5a51e3da65b4f04d85f1 100644 (file)
@@ -2727,7 +2727,7 @@ static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[],
        }
 
        if (tb[IFLA_MTU]) {
-               u32 mtu = nla_get_u32(data[IFLA_MTU]);
+               u32 mtu = nla_get_u32(tb[IFLA_MTU]);
 
                if (mtu < ETH_MIN_MTU || mtu > ETH_MAX_MTU)
                        return -EINVAL;