Messages in this thread | | | Date | Wed, 7 Jun 2017 16:18:39 +0200 | From | Florian Westphal <> | Subject | Re: [PATCH v2] decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb |
| |
Mateusz Jurczyk <mjurczyk@google.com> wrote: > Verify that the length of the socket buffer is sufficient to cover the > nlmsghdr structure before accessing the nlh->nlmsg_len field for further > input sanitization. If the client only supplies 1-3 bytes of data in > sk_buff, then nlh->nlmsg_len remains partially uninitialized and > contains leftover memory from the corresponding kernel allocation. > Operating on such data may result in indeterminate evaluation of the > nlmsg_len < sizeof(*nlh) expression. > > The bug was discovered by a runtime instrumentation designed to detect > use of uninitialized memory in the kernel. The patch prevents this and > other similar tools (e.g. KMSAN) from flagging this behavior in the future.
Instead of changing all the internal users wouldn't it be better to add this check once in netlink_unicast_kernel?
| |