rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

JIRA: https://issues.redhat.com/browse/RHEL-39715
CVE: CVE-2024-36017
Upstream Status: net.git commit 1aec77b

commit 1aec77b
Author: Roded Zats <rzats@paloaltonetworks.com>
Date:   Thu May 2 18:57:51 2024 +0300

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

    Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a
    struct ifla_vf_vlan_info so the size of such attribute needs to be at least
    of sizeof(struct ifla_vf_vlan_info) which is 14 bytes.
    The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)
    which is less than sizeof(struct ifla_vf_vlan_info) so this validation
    is not enough and a too small attribute might be cast to a
    struct ifla_vf_vlan_info, this might result in an out of bands
    read access when accessing the saved (casted) entry in ivvl.

    Fixes: 79aab09 ("net: Update API for VF vlan protocol 802.1ad support")
    Signed-off-by: Roded Zats <rzats@paloaltonetworks.com>
    Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
    Link: https://lore.kernel.org/r/20240502155751.75705-1-rzats@paloaltonetworks.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Author: dcaratti

net/core/rtnetlink.c

@@ -2567,7 +2567,7 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 
 		nla_for_each_nested(attr, tb[IFLA_VF_VLAN_LIST], rem) {
 			if (nla_type(attr) != IFLA_VF_VLAN_INFO ||
-			    nla_len(attr) < NLA_HDRLEN) {
+			    nla_len(attr) < sizeof(struct ifla_vf_vlan_info)) {
 				return -EINVAL;
 			}
 			if (len >= MAX_VLAN_LIST_LEN)