NLA_BINARY misuse bug in HSR

Removed .type field from NLA to do proper length checking.
Reported by Daniel Borkmann and Julia Lawall.

Signed-off-by: Peter Heise <peter.heise@airbus.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 4 deletions

diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 5425d87611fc..d4d1617f43a8 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -24,7 +24,7 @@ static const struct nla_policy hsr_policy[IFLA_HSR_MAX + 1] = {
         [IFLA_HSR_SLAVE2]               = { .type = NLA_U32 },
         [IFLA_HSR_MULTICAST_SPEC]       = { .type = NLA_U8 },
         [IFLA_HSR_VERSION]      = { .type = NLA_U8 },
-        [IFLA_HSR_SUPERVISION_ADDR]     = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [IFLA_HSR_SUPERVISION_ADDR]     = { .len = ETH_ALEN },
         [IFLA_HSR_SEQ_NR]               = { .type = NLA_U16 },
 };
 
@@ -121,10 +121,9 @@ static struct rtnl_link_ops hsr_link_ops __read_mostly = {
 
 
 /* attribute policy */
-/* NLA_BINARY missing in libnl; use NLA_UNSPEC in userspace instead. */
 static const struct nla_policy hsr_genl_policy[HSR_A_MAX + 1] = {
-        [HSR_A_NODE_ADDR] = { .type = NLA_BINARY, .len = ETH_ALEN },
-        [HSR_A_NODE_ADDR_B] = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [HSR_A_NODE_ADDR] = { .len = ETH_ALEN },
+        [HSR_A_NODE_ADDR_B] = { .len = ETH_ALEN },
         [HSR_A_IFINDEX] = { .type = NLA_U32 },
         [HSR_A_IF1_AGE] = { .type = NLA_U32 },
         [HSR_A_IF2_AGE] = { .type = NLA_U32 },