Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 25 Jul 2023 13:40:09 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Lin Ma <linma@zju.edu.cn>
Cc:     davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Herbert Xu <herbert@gondor.apana.org.au>
Subject: Re: [PATCH v1] macvlan: add forgotten nla_policy for
 IFLA_MACVLAN_BC_CUTOFF
Message-ID: <ZL+0mUhvnvDyyK9o@corigine.com>
References: <20230723080205.3715164-1-linma@zju.edu.cn>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230723080205.3715164-1-linma@zju.edu.cn>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?dpVFnsra9jgGg5bn27B6E/hPIR1xMmQc+ocb88IjUxE9WhKFx4Xbf60kCA7G?=
 =?us-ascii?Q?3TPUQ0kD7a6AxewajhRexYDmRuoucZnOnyjX+ioRlsTHUKsswRqhLh1ZJyuc?=
 =?us-ascii?Q?nfwdjnx16ntmsjCtdJnwDP4RP2TtDBWEiw2Ehnf+d+LAY2z11/T1y+8bZCs2?=
 =?us-ascii?Q?ro7MOBs2jCOzy0TMlxySsMoBel7dhgGpokPIakL1YP3nmkeI154HeEKePHbd?=
 =?us-ascii?Q?pM/7kQFb+VyxuX0Ho55IPQWIbru3sut8eat+YkWgXv244+Q0xpcboo5K4szX?=
 =?us-ascii?Q?/s5zP8vQ0RaTfgl0Yan/5px1RnYAfbTmpJP47viMzFVlZORwIDyO7u4xjgGf?=
 =?us-ascii?Q?5X3zw+6sV7SnQPHiFku4eJOMTCPc5iIdmh1uahfHPBrCjdXJVvS/mH1LsXs3?=
 =?us-ascii?Q?UZcrfvQYaAKdlz4JSjeyiBNgSGTpacHgXE8kfyuMQzDUZ4mZgEgso86wFsuv?=
 =?us-ascii?Q?OwQ6qCT1qB+kedwCufPWYAwk7af6PgGgFbhLj0typVoxviZp+QzicZ7ruuMr?=
 =?us-ascii?Q?WIfDWRFxYET9iiV5Fr5fhltnz9A2DcNgEuIDk+ZfHNQUa+lWh5KsJ/l5YHrF?=
 =?us-ascii?Q?l9v3RPuGnDfgFQ/pmZJbeQ/4KFM1RrG/qXzzAST6PtTb8IUtnLrMBes3Gt+W?=
 =?us-ascii?Q?T7ZePOZeygH+BCgZsOVRBJOJ5eaVwKqGpBAC9mJfMP2d/9Lr17vdRxi/gdr1?=
 =?us-ascii?Q?8lGwwudRufBRXPVvKWLlII8G9Aci9p921ngAMWwpHb5VpIsz1dtqIjkssSnq?=
 =?us-ascii?Q?aGXzCCtoIUjOW+MBzZPnK5EfrFDcyIrzoP/vgHaVF+u3y21Q2TJkhJPxH07r?=
 =?us-ascii?Q?Xyip15ZyjsWdf+azfKH8oUmO000S327Tihgb05f1Fnj9iQg3D9SIcoEfjPrq?=
 =?us-ascii?Q?Qh7kUybBBG5+5Eg9+ChutvJS18zykW4nVwtMUTLyf2b3S7L70F1BSPegjGBo?=
 =?us-ascii?Q?AbNZG+0Hmzo/4twTM4GQ+Bqrixd1Lz3HTFQGt5AZo9PNsuDvQp+iISwVMTYr?=
 =?us-ascii?Q?hiElaGZb4/2GBsvx5aNkUviKcLmGpDkyJ3SEKeQ+C7GYK4XcrIRfuz7Xul0o?=
 =?us-ascii?Q?r8Dson6VdlFmD9BrO46XV9VDTbodFljo8UlZRHdKxXo1Iia78TsV9IANH9Sd?=
 =?us-ascii?Q?7SIrQhW0U2zd+/jbP4/3aXW7kAC5tREQfbP6YOesgnnvgDS67S/D/mEmcHgm?=
 =?us-ascii?Q?pYujxNGOaRkNyyocUTU6FovQdS0KUCkrttXg5bCUwU0/ztFrjyBZsdTVsoAE?=
 =?us-ascii?Q?XkJxtgIbsJstObZr4mmocHXVw9q30jb2jbxIkaiklsdcVpMa5uxRwWAdxLvO?=
 =?us-ascii?Q?jBNdCeZ5YZNdMeO8+kEy+mqZ4Ivlt/k4i3i+rFh6B0wiIh6xaJpy0LpdT4Y2?=
 =?us-ascii?Q?Q1lzu6Q5EAIjDlzkmMlc0aJj9ZFJVeKB0/r5jxMjYCdFKQgyyut4Q4JkfLqR?=
 =?us-ascii?Q?6d+QGnOVESO6g7MTWbBgDxlgfNjfVgBVdbURpu3V7stNQuHytPoJRBm8i/5u?=
 =?us-ascii?Q?XYttT3wWQNnTizxclxrOlZn88Naba4sLSTtfOmJylbCtzRJ/fvhIWKz3Z6Wi?=
 =?us-ascii?Q?CrrnMc6vGMXE/eul+yAoGcrAyKot8bwdlNTvtUWQmxHo0ZH33IrbQq2wBOKM?=
 =?us-ascii?Q?qRuMPHkvSF6BDX/sRH45QKpW8XCb4Kki69Vc+xbsuDQqVXmK9xYMA6J3Jj7f?=
 =?us-ascii?Q?OXVdtw=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c9c727e2-77e6-42dc-6a26-08db8d03e9e4
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Jul 2023 11:40:15.2710
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: f0AmqUFeSjkXb/QBhL1vLNM6EC3GnUXynDoMhdS8CBgUiukfktzFWK7936MJar8qJVC3vI3RgMd2ZEpfwR2gkUZZz0+WTyf2YxWyNIf9YRo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR13MB5628
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,
        SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

+ Herbert Xu

On Sun, Jul 23, 2023 at 04:02:05PM +0800, Lin Ma wrote:
> The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for
> broadcast cutoff") added one additional attribute named
> IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff.
> 
> However, it forgot to describe the nla_policy at macvlan_policy
> (drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer
> can be faked as empty (0 bytes) by a malicious user, which could leads
> to OOB in heap just like CVE-2023-3773.
> 
> To fix it, this commit just completes the nla_policy description for
> IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the
> potential OOB read.
> 
> Fixes: 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff")
> Signed-off-by: Lin Ma <linma@zju.edu.cn>

Reviewed-by: Simon Horman <simon.horman@corigine.com>

> ---
>  drivers/net/macvlan.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
> index 4a53debf9d7c..ed908165a8b4 100644
> --- a/drivers/net/macvlan.c
> +++ b/drivers/net/macvlan.c
> @@ -1746,6 +1746,7 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
>  	[IFLA_MACVLAN_MACADDR_COUNT] = { .type = NLA_U32 },
>  	[IFLA_MACVLAN_BC_QUEUE_LEN] = { .type = NLA_U32 },
>  	[IFLA_MACVLAN_BC_QUEUE_LEN_USED] = { .type = NLA_REJECT },
> +	[IFLA_MACVLAN_BC_CUTOFF] = { .type = NLA_S32 },
>  };
>  
>  int macvlan_link_register(struct rtnl_link_ops *ops)
> -- 
> 2.17.1
> 
>