From: Jiri Pirko Date: Thu, 7 Dec 2023 12:53:51 +0000 (+0100) Subject: mnl_utils: sanitize incoming netlink payload size in callbacks X-Git-Tag: v6.7.0~34 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1a68525f4613b4e02e83d4b8004f22ac7ecbfedf;p=thirdparty%2Fiproute2.git mnl_utils: sanitize incoming netlink payload size in callbacks Don't trust the kernel to send payload of certain size. Sanitize that by checking the payload length in mnlu_cb_stop() and mnlu_cb_error() and only access the payload if it is of required size. Note that for mnlu_cb_stop(), this is happening already for example with devlink resource. Kernel sends NLMSG_DONE with zero size payload. Fixes: 049c58539f5d ("devlink: mnlg: Add support for extended ack") Fixes: c934da8aaacb ("devlink: mnlg: Catch returned error value of dumpit commands") Signed-off-by: Jiri Pirko Signed-off-by: Stephen Hemminger --- diff --git a/lib/mnl_utils.c b/lib/mnl_utils.c index 1c7822282..af5aa4f9e 100644 --- a/lib/mnl_utils.c +++ b/lib/mnl_utils.c @@ -61,6 +61,8 @@ static int mnlu_cb_error(const struct nlmsghdr *nlh, void *data) { const struct nlmsgerr *err = mnl_nlmsg_get_payload(nlh); + if (mnl_nlmsg_get_payload_len(nlh) < sizeof(*err)) + return MNL_CB_STOP; /* Netlink subsystems returns the errno value with different signess */ if (err->error < 0) errno = -err->error; @@ -75,8 +77,11 @@ static int mnlu_cb_error(const struct nlmsghdr *nlh, void *data) static int mnlu_cb_stop(const struct nlmsghdr *nlh, void *data) { - int len = *(int *)NLMSG_DATA(nlh); + int len; + if (mnl_nlmsg_get_payload_len(nlh) < sizeof(len)) + return MNL_CB_STOP; + len = *(int *)mnl_nlmsg_get_payload(nlh); if (len < 0) { errno = -len; nl_dump_ext_ack_done(nlh, sizeof(int), len);