veth: Enforce minimum size of VETH_INFO_PEER
authorThomas Graf <tgraf@suug.ch>
Wed, 15 Feb 2012 04:09:46 +0000 (04:09 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 15 Feb 2012 19:59:20 +0000 (14:59 -0500)
VETH_INFO_PEER carries struct ifinfomsg plus optional IFLA
attributes. A minimal size of sizeof(struct ifinfomsg) must be
enforced or we may risk accessing that struct beyond the limits
of the netlink message.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/veth.c

index 49f4667e1fa3c20342b1ca18240a93ece55f9016..4a3402898f2a1100fdae0b38d65d172a8c160da9 100644 (file)
@@ -422,7 +422,9 @@ static void veth_dellink(struct net_device *dev, struct list_head *head)
        unregister_netdevice_queue(peer, head);
 }
 
-static const struct nla_policy veth_policy[VETH_INFO_MAX + 1];
+static const struct nla_policy veth_policy[VETH_INFO_MAX + 1] = {
+       [VETH_INFO_PEER]        = { .len = sizeof(struct ifinfomsg) },
+};
 
 static struct rtnl_link_ops veth_link_ops = {
        .kind           = DRV_NAME,