From: Greg Kroah-Hartman <gregkh@linuxfoundation•org>
To: stable@vger•kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation•org>,
patches@lists•linux.dev, Jakub Kicinski <kuba@kernel•org>,
Pablo Neira Ayuso <pablo@netfilter•org>,
Jozsef Kadlecsik <kadlec@netfilter•org>,
Florian Westphal <fw@strlen•de>,
"David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Paolo Abeni <pabeni@redhat•com>,
syzbot <syzkaller@googlegroups•com>,
netfilter-devel@vger•kernel.org, coreteam@netfilter•org,
netdev@vger•kernel.org, Kees Cook <keescook@chromium•org>
Subject: [PATCH 6.0 306/314] netlink: Bounds-check struct nlmsgerr creation
Date: Wed, 23 Nov 2022 09:52:31 +0100 [thread overview]
Message-ID: <20221123084639.430560487@linuxfoundation.org> (raw)
In-Reply-To: <20221123084625.457073469@linuxfoundation.org>
From: Kees Cook <keescook@chromium•org>
commit 710d21fdff9a98d621cd4e64167f3ef8af4e2fd1 upstream.
In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),
switch from __nlmsg_put to nlmsg_put(), and explain the bounds check
for dealing with the memcpy() across a composite flexible array struct.
Avoids this future run-time warning:
memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)
Cc: Jakub Kicinski <kuba@kernel•org>
Cc: Pablo Neira Ayuso <pablo@netfilter•org>
Cc: Jozsef Kadlecsik <kadlec@netfilter•org>
Cc: Florian Westphal <fw@strlen•de>
Cc: "David S. Miller" <davem@davemloft•net>
Cc: Eric Dumazet <edumazet@google•com>
Cc: Paolo Abeni <pabeni@redhat•com>
Cc: syzbot <syzkaller@googlegroups•com>
Cc: netfilter-devel@vger•kernel.org
Cc: coreteam@netfilter•org
Cc: netdev@vger•kernel.org
Signed-off-by: Kees Cook <keescook@chromium•org>
Link: https://lore.kernel.org/r/20220901071336.1418572-1-keescook@chromium.org
Signed-off-by: David S. Miller <davem@davemloft•net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation•org>
---
net/netfilter/ipset/ip_set_core.c | 8 +++++---
net/netlink/af_netlink.c | 8 +++++---
2 files changed, 10 insertions(+), 6 deletions(-)
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1719,11 +1719,13 @@ call_ad(struct net *net, struct sock *ct
skb2 = nlmsg_new(payload, GFP_KERNEL);
if (!skb2)
return -ENOMEM;
- rep = __nlmsg_put(skb2, NETLINK_CB(skb).portid,
- nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
+ rep = nlmsg_put(skb2, NETLINK_CB(skb).portid,
+ nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
errmsg = nlmsg_data(rep);
errmsg->error = ret;
- memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
+ unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len,
+ /* Bounds checked by the skb layer. */);
+
cmdattr = (void *)&errmsg->msg + min_len;
ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2440,11 +2440,13 @@ void netlink_ack(struct sk_buff *in_skb,
return;
}
- rep = __nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
- NLMSG_ERROR, payload, flags);
+ rep = nlmsg_put(skb, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
+ NLMSG_ERROR, payload, flags);
errmsg = nlmsg_data(rep);
errmsg->error = err;
- memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
+ unsafe_memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg)
+ ? nlh->nlmsg_len : sizeof(*nlh),
+ /* Bounds checked by the skb layer. */);
if (nlk_has_extack && extack) {
if (extack->_msg) {
parent reply other threads:[~2022-11-23 10:10 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <20221123084625.457073469@linuxfoundation.org>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221123084639.430560487@linuxfoundation.org \
--to=gregkh@linuxfoundation$(echo .)org \
--cc=coreteam@netfilter$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=fw@strlen$(echo .)de \
--cc=kadlec@netfilter$(echo .)org \
--cc=keescook@chromium$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pablo@netfilter$(echo .)org \
--cc=patches@lists$(echo .)linux.dev \
--cc=stable@vger$(echo .)kernel.org \
--cc=syzkaller@googlegroups$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox