netdev - [NETLINK]: Fix nla_parse_nested_compat() to call nla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 22 May 2008 13:37:20 +0200
From:	Thomas Graf <tgraf@...g.ch>
To:	davem@...emloft.net, Stephen Hemminger <shemminger@...tta.com>
Cc:	Dave Jones <davej@...emonkey.org.uk>, netdev@...r.kernel.org
Subject: [NETLINK]: Fix nla_parse_nested_compat() to call nla_parse() directly

The purpose of nla_parse_nested_compat() is to parse attributes
which contain a struct followed by a stream of nested attributes.
So far, it called nla_parse_nested() to parse the stream of
nested attributes which was wrong, as nla_parse_nested() expects
a container attribute as data which holds the attribute stream.
It needs to call nla_parse() directly while pointing at the
next possible alignment point after the struct in the beginning
of the attribute.

With this patch, I can no longer reproduce the reported leftover
warnings.

Signed-off-by: Thomas Graf <tgraf@...g.ch>

Index: net-2.6/include/net/netlink.h
===================================================================
--- net-2.6.orig/include/net/netlink.h	2008-05-22 13:00:10.000000000 +0200
+++ net-2.6/include/net/netlink.h	2008-05-22 13:02:08.000000000 +0200
@@ -772,12 +772,13 @@
 					    const struct nla_policy *policy,
 					    int len)
 {
-	if (nla_len(nla) < len)
+	int nested_len = nla_len(nla) - NLA_ALIGN(len);
+
+	if (nested_len < 0)
 		return -1;
-	if (nla_len(nla) >= NLA_ALIGN(len) + sizeof(struct nlattr))
-		return nla_parse_nested(tb, maxtype,
-					nla_data(nla) + NLA_ALIGN(len),
-					policy);
+	if (nested_len >= nla_attr_size(0))
+		return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
+				 nested_len, policy);
 	memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
 	return 0;
 }
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html