Re: [PATCH net v3] team: validate the length of U32 and S32 option data

[Jiri Pirko <jiri@resnulli.us>]

Fri, Nov 13, 2026 at 10:01:08AM +0100, sunwenbo@cmss.chinamobile.com wrote:
>In team_nl_options_set_doit(), the policy for TEAM_ATTR_OPTION_DATA in
>team_attr_option_nl_policy is NLA_BINARY because the payload layout
>varies with the option type.
>
>For TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32, the payload is
>read directly with nla_get_u32(attr_data) and nla_get_s32(attr_data)
>without checking its attribute length. When userspace supplies a
>truncated attribute (0 to 3 bytes), nla_get_u32() or nla_get_s32()
>performs an out-of-bounds read past the attribute buffer. Conversely,
>oversized payloads (> 4 bytes) would also have trailing bytes
>silently ignored instead of being rejected as invalid input.
>
>Validate that nla_len(attr_data) equals sizeof(u32) or sizeof(s32)
>for TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32 respectively, and
>return -EINVAL otherwise, consistent with how NLA_U32/NLA_S32
>attributes are validated and similar to commit 5bef3ac184b5 ("team:
>better TEAM_OPTION_TYPE_STRING validation").
>
>This issue was identified with the assistance of an LLM-based code
>review of Netlink option handlers in the team driver, confirmed by
>sending malformed U32 (notify_peers_count) and S32 (priority) option
>attributes on a UML kernel, and verified after the patch that
>invalid lengths (0..3, 5, and 8 bytes) are rejected with -EINVAL while
>valid 4-byte options still work as expected.
>
>Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with
>zero new warnings or errors.
>
>Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
>Fixes: 69821638b274 ("team: add signed 32-bit team option type")
>Signed-off-by: Wenbo Sun <sunwenbo@cmss.chinamobile.com>

Reviewed-by: Jiri Pirko <jiri@nvidia.com>