Subject: Re: [PATCH net-next 1/2] nexthop: Fix out-of-bounds access during attribute validation

From: Jakub Kicinski <[email-masked]>
Date: Mon, 11 Mar 2024 07:47:02 -0700

On Sun, 10 Mar 2024 23:41:53 +0200 Ido Schimmel wrote:
> > 'tb' on the stack only needs to be ARRAY_SIZE as well; that's the
> > benefit of the approach - only declare what you need.  
> 
> The reasoning for that is explained in Petr's commit message:
> 
> "
>     - To allow querying for presence of the attribute, have all the attribute
>       arrays sized to NHA_MAX, regardless of what is permitted by policy, and
>       pass the corresponding value to nlmsg_parse() as well.
> "
> 
> IOW, with resizing 'tb' to ARRAY_SIZE:
> 
> rtm_del_nexthop
>     nh_valid_get_del_req
>         if (tb[NHA_OP_FLAGS]) -> BOOM

v2 coming, right? Please repost as soon as possible. v1 crashes AFAICT
because tb is not 0-initialized so tb[NHA_OP_FLAGS] reads garbage.