In team_nl_options_set_doit(), the policy for TEAM_ATTR_OPTION_DATA in team_attr_option_nl_policy is NLA_BINARY because the payload layout varies with the option type. For TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32, the payload is read directly with nla_get_u32(attr_data) and nla_get_s32(attr_data) without checking its attribute length. When userspace supplies a truncated attribute (0 to 3 bytes), nla_get_u32() or nla_get_s32() performs an out-of-bounds read past the attribute buffer. Conversely, oversized payloads (> 4 bytes) would also have trailing bytes silently ignored instead of being rejected as invalid input. Validate that nla_len(attr_data) equals sizeof(u32) or sizeof(s32) for TEAM_OPTION_TYPE_U32 and TEAM_OPTION_TYPE_S32 respectively, and return -EINVAL otherwise, consistent with how NLA_U32/NLA_S32 attributes are validated and similar to commit 5bef3ac184b5 ("team: better TEAM_OPTION_TYPE_STRING validation"). This issue was identified with the assistance of an LLM-based code review of Netlink option handlers in the team driver, confirmed by sending malformed U32 (notify_peers_count) and S32 (priority) option attributes on a UML kernel, and verified after the patch that invalid lengths (0..3, 5, and 8 bytes) are rejected with -EINVAL while valid 4-byte options still work as expected. Built with W=1 on UML, x86_64 allmodconfig, and x86_64 allyesconfig with zero new warnings or errors. Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") Fixes: 69821638b274 ("team: add signed 32-bit team option type") Signed-off-by: Wenbo Sun --- Changes in v3: - Add Fixes: 69821638b274 ("team: add signed 32-bit team option type") for the TEAM_OPTION_TYPE_S32 check, as suggested by Hangbin Liu. - Rebase onto latest mainline (7e1392a42ea2) with no functional code changes. - Link to v2: https://lore.kernel.org/r/20261112090030.172342-1-sunwenbo@cmss.chinamobile.com Changes in v2: - Check exact length (!= sizeof(u32) / != sizeof(s32)) instead of only rejecting truncated payloads (<), as suggested by Hangbin Liu. - Extended the UML test to also cover oversized option payloads. - Link to v1: https://lore.kernel.org/r/20261111085924.360720-1-sunwenbo@cmss.chinamobile.com drivers/net/team/team_core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c index cfb833c307c1..65ac25e97ae3 100644 --- a/drivers/net/team/team_core.c +++ b/drivers/net/team/team_core.c @@ -2834,6 +2834,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info) ctx.info = opt_inst_info; switch (opt_type) { case TEAM_OPTION_TYPE_U32: + if (nla_len(attr_data) != sizeof(u32)) { + err = -EINVAL; + goto team_put; + } ctx.data.u32_val = nla_get_u32(attr_data); break; case TEAM_OPTION_TYPE_STRING: @@ -2853,6 +2857,10 @@ int team_nl_options_set_doit(struct sk_buff *skb, struct genl_info *info) ctx.data.bool_val = attr_data ? true : false; break; case TEAM_OPTION_TYPE_S32: + if (nla_len(attr_data) != sizeof(s32)) { + err = -EINVAL; + goto team_put; + } ctx.data.s32_val = nla_get_s32(attr_data); break; default: -- 2.33.0