Subject: Re: old NLMSG_OK fix

From: "David S. Miller" <[email-masked]>
Date: Mon, 28 Jun 2004 11:22:58 -0700

On Mon, 28 Jun 2004 19:43:37 +1000
Herbert Xu <[email-masked]> wrote:

> David S. Miller <[email-masked]> wrote:
> > On Sun, 27 Jun 2004 19:15:52 +0200
> > Christoph Hellwig <[email-masked]> wrote:
> > 
> >> http://oss.sgi.com/projects/netdev/archive/2000-09/msg00001.html
> > 
> > It works because there is always 16 bytes of scratch at the end of an
> > SKB more than was allocated for the actual data.  So blindly deref'ing
> > the nlmsg_len value is fine here.
> 
> Yes but this is also used by user-space appliations where this scratch
> space may not exist.  NETLINK messages can travel from one application
> to another so exploits are possible.

You're right, thanks for pointing this out.  I'll add it to my tree.