Commit 710d21fd authored by Kees Cook's avatar Kees Cook Committed by David S. Miller
Browse files

netlink: Bounds-check struct nlmsgerr creation 



In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),
switch from __nlmsg_put to nlmsg_put(), and explain the bounds check
for dealing with the memcpy() across a composite flexible array struct.
Avoids this future run-time warning:

  memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)

Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: syzbot <syzkaller@googlegroups.com>
Cc: netfilter-devel@vger.kernel.org
Cc: coreteam@netfilter.org
Cc: netdev@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220901071336.1418572-1-keescook@chromium.org


Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 05ad5d45

net/netfilter/ipset/ip_set_core.c

+5 −3
Original line number Diff line number Diff line
@@ -1719,11 +1719,13 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb, 
		skb2 = nlmsg_new(payload, GFP_KERNEL);

		if (!skb2)

			return -ENOMEM;

		rep = __nlmsg_put(skb2, NETLINK_CB(skb).portid,

		rep = nlmsg_put(skb2, NETLINK_CB(skb).portid,

				nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);

		errmsg = nlmsg_data(rep);

		errmsg->error = ret;

		memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);

		unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len,

			      /* Bounds checked by the skb layer. */);



		cmdattr = (void *)&errmsg->msg + min_len;



		ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,

net/netlink/af_netlink.c

+5 −3
Original line number Diff line number Diff line
@@ -2494,11 +2494,13 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, 
		return;

	}



	rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,

	rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,

			NLMSG_ERROR, payload, flags);

	errmsg = nlmsg_data(rep);

	errmsg->error = err;

	memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));

	unsafe_memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg)

					 ? nlh->nlmsg_len : sizeof(*nlh),

		      /* Bounds checked by the skb layer. */);



	if (tlvlen)

		netlink_ack_tlv_fill(in_skb, skb, nlh, err, extack);