netdev - Re: [PATCH net-next] genetlink: start to validate reserved header bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 25 Aug 2022 15:21:52 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     davem@...emloft.net, netdev@...r.kernel.org, edumazet@...gle.com,
        pabeni@...hat.com, jiri@...nulli.us, johannes@...solutions.net,
        linux-block@...r.kernel.org, osmocom-net-gprs@...ts.osmocom.org,
        linux-wpan@...r.kernel.org, wireguard@...ts.zx2c4.com,
        linux-wireless@...r.kernel.org, linux-scsi@...r.kernel.org,
        target-devel@...r.kernel.org, linux-pm@...r.kernel.org,
        virtualization@...ts.linux-foundation.org,
        linux-cifs@...r.kernel.org, cluster-devel@...hat.com,
        mptcp@...ts.linux.dev, lvs-devel@...r.kernel.org,
        netfilter-devel@...r.kernel.org,
        linux-security-module@...r.kernel.org, dev@...nvswitch.org,
        linux-s390@...r.kernel.org, tipc-discussion@...ts.sourceforge.net
Subject: Re: [PATCH net-next] genetlink: start to validate reserved header bytes

On Wed, Aug 24, 2022 at 8:18 PM Jakub Kicinski <kuba@...nel.org> wrote:
>
> We had historically not checked that genlmsghdr.reserved
> is 0 on input which prevents us from using those precious
> bytes in the future.
>
> One use case would be to extend the cmd field, which is
> currently just 8 bits wide and 256 is not a lot of commands
> for some core families.
>
> To make sure that new families do the right thing by default
> put the onus of opting out of validation on existing families.
>
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> ---
> CC: jiri@...nulli.us
> CC: johannes@...solutions.net
> CC: linux-block@...r.kernel.org
> CC: osmocom-net-gprs@...ts.osmocom.org
> CC: linux-wpan@...r.kernel.org
> CC: wireguard@...ts.zx2c4.com
> CC: linux-wireless@...r.kernel.org
> CC: linux-scsi@...r.kernel.org
> CC: target-devel@...r.kernel.org
> CC: linux-pm@...r.kernel.org
> CC: virtualization@...ts.linux-foundation.org
> CC: linux-cifs@...r.kernel.org
> CC: cluster-devel@...hat.com
> CC: mptcp@...ts.linux.dev
> CC: lvs-devel@...r.kernel.org
> CC: netfilter-devel@...r.kernel.org
> CC: linux-security-module@...r.kernel.org
> CC: dev@...nvswitch.org
> CC: linux-s390@...r.kernel.org
> CC: tipc-discussion@...ts.sourceforge.net
> ---
>  drivers/block/nbd.c                      | 1 +
>  drivers/net/gtp.c                        | 1 +
>  drivers/net/ieee802154/mac802154_hwsim.c | 1 +
>  drivers/net/macsec.c                     | 1 +
>  drivers/net/team/team.c                  | 1 +
>  drivers/net/wireguard/netlink.c          | 1 +
>  drivers/net/wireless/mac80211_hwsim.c    | 1 +
>  drivers/target/target_core_user.c        | 1 +
>  drivers/thermal/thermal_netlink.c        | 1 +
>  drivers/vdpa/vdpa.c                      | 1 +
>  fs/cifs/netlink.c                        | 1 +
>  fs/dlm/netlink.c                         | 1 +
>  fs/ksmbd/transport_ipc.c                 | 1 +
>  include/linux/genl_magic_func.h          | 1 +
>  include/net/genetlink.h                  | 3 +++
>  kernel/taskstats.c                       | 1 +
>  net/batman-adv/netlink.c                 | 1 +
>  net/core/devlink.c                       | 1 +
>  net/core/drop_monitor.c                  | 1 +
>  net/ethtool/netlink.c                    | 1 +
>  net/hsr/hsr_netlink.c                    | 1 +
>  net/ieee802154/netlink.c                 | 1 +
>  net/ieee802154/nl802154.c                | 1 +
>  net/ipv4/fou.c                           | 1 +
>  net/ipv4/tcp_metrics.c                   | 1 +
>  net/ipv6/ila/ila_main.c                  | 1 +
>  net/ipv6/ioam6.c                         | 1 +
>  net/ipv6/seg6.c                          | 1 +
>  net/l2tp/l2tp_netlink.c                  | 1 +
>  net/mptcp/pm_netlink.c                   | 1 +
>  net/ncsi/ncsi-netlink.c                  | 1 +
>  net/netfilter/ipvs/ip_vs_ctl.c           | 1 +
>  net/netlabel/netlabel_calipso.c          | 1 +
>  net/netlabel/netlabel_cipso_v4.c         | 1 +
>  net/netlabel/netlabel_mgmt.c             | 1 +
>  net/netlabel/netlabel_unlabeled.c        | 1 +
>  net/netlink/genetlink.c                  | 4 ++++
>  net/nfc/netlink.c                        | 1 +
>  net/openvswitch/conntrack.c              | 1 +
>  net/openvswitch/datapath.c               | 3 +++
>  net/openvswitch/meter.c                  | 1 +
>  net/psample/psample.c                    | 1 +
>  net/smc/smc_netlink.c                    | 3 ++-
>  net/smc/smc_pnet.c                       | 3 ++-
>  net/tipc/netlink.c                       | 1 +
>  net/tipc/netlink_compat.c                | 1 +
>  net/wireless/nl80211.c                   | 1 +
>  47 files changed, 56 insertions(+), 2 deletions(-)

Acked-by: Paul Moore <paul@...l-moore.com> (NetLabel)

-- 
paul-moore.com