lkml.org 
[lkml]   [2022]   [Aug]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/2] netlink: Bounds-check nlmsg_len()
On Wed, 31 Aug 2022 20:06:09 -0700 Kees Cook wrote:
> static inline int nlmsg_len(const struct nlmsghdr *nlh)
> {
> - return nlh->nlmsg_len - NLMSG_HDRLEN;
> + u32 nlmsg_contents_len;
> +
> + if (WARN_ON_ONCE(check_sub_overflow(nlh->nlmsg_len,
> + (u32)NLMSG_HDRLEN,
> + &nlmsg_contents_len)))
> + return 0;
> + if (WARN_ON_ONCE(nlmsg_contents_len > INT_MAX))
> + return INT_MAX;
> + return nlmsg_contents_len;

We check the messages on input, making sure the length is valid wrt
skb->len, and sane, ie > NLMSG_HDRLEN. See netlink_rcv_skb().

Can we not, pretty please? :(

\
 
 \ /
  Last update: 2022-09-01 05:19    [W:0.073 / U:0.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site