netlink: Bounds-check struct nlmsgerr creation

In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),
switch from __nlmsg_put to nlmsg_put(), and explain the bounds check
for dealing with the memcpy() across a composite flexible array struct.
Avoids this future run-time warning:

  memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)

Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: syzbot <syzkaller@googlegroups.com>
Cc: netfilter-devel@vger.kernel.org
Cc: coreteam@netfilter.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220901071336.1418572-1-keescook@chromium.org
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/kernel/net/netfilter/ipset/ip_set_core.c b/kernel/net/netfilter/ipset/ip_set_core.c
index 0fdafb7fcd79131791fc592332d4e1db2d38b46d..037b2ce91b3f3be3a8340e252a75fcd0bac8d852 100644 (file)
--- a/kernel/net/netfilter/ipset/ip_set_core.c
+++ b/kernel/net/netfilter/ipset/ip_set_core.c
@@ -1775,11 +1775,12 @@ CALL_AD(struct net *net, struct sock *ctnl, struct sk_buff *skb,
                skb2 = nlmsg_new(payload, GFP_KERNEL);
                if (!skb2)
                        return -ENOMEM;
-               rep = __nlmsg_put(skb2, NETLINK_PORTID(skb),
-                                 nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
+               rep = nlmsg_put(skb2, NETLINK_PORTID(skb),
+                               nlh->nlmsg_seq, NLMSG_ERROR, payload, 0);
                errmsg = nlmsg_data(rep);
                errmsg->error = ret;
-               memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
+               unsafe_memcpy(&errmsg->msg, nlh, nlh->nlmsg_len,
+                             /* Bounds checked by the skb layer. */);
                cmdattr = (void *)&errmsg->msg + min_len;
 
                ret = NLA_PARSE(cda, IPSET_ATTR_CMD_MAX, cmdattr,