netdev - [patch iproute2] mnl_utils: sanitize incoming netlink payload size in callbacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231207125351.965767-1-jiri@resnulli.us>
Date: Thu,  7 Dec 2023 13:53:51 +0100
From: Jiri Pirko <jiri@...nulli.us>
To: netdev@...r.kernel.org
Cc: stephen@...workplumber.org,
	dsahern@...il.com,
	moche@...dia.com
Subject: [patch iproute2] mnl_utils: sanitize incoming netlink payload size in callbacks

From: Jiri Pirko <jiri@...dia.com>

Don't trust the kernel to send payload of certain size. Sanitize that by
checking the payload length in mnlu_cb_stop() and mnlu_cb_error() and
only access the payload if it is of required size.

Note that for mnlu_cb_stop(), this is happening already for example
with devlink resource. Kernel sends NLMSG_DONE with zero size payload.

Fixes: 049c58539f5d ("devlink: mnlg: Add support for extended ack")
Fixes: c934da8aaacb ("devlink: mnlg: Catch returned error value of dumpit commands")
Signed-off-by: Jiri Pirko <jiri@...dia.com>
---
 lib/mnl_utils.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lib/mnl_utils.c b/lib/mnl_utils.c
index 1c78222828ff..af5aa4f9eda4 100644
--- a/lib/mnl_utils.c
+++ b/lib/mnl_utils.c
@@ -61,6 +61,8 @@ static int mnlu_cb_error(const struct nlmsghdr *nlh, void *data)
 {
 	const struct nlmsgerr *err = mnl_nlmsg_get_payload(nlh);
 
+	if (mnl_nlmsg_get_payload_len(nlh) < sizeof(*err))
+		return MNL_CB_STOP;
 	/* Netlink subsystems returns the errno value with different signess */
 	if (err->error < 0)
 		errno = -err->error;
@@ -75,8 +77,11 @@ static int mnlu_cb_error(const struct nlmsghdr *nlh, void *data)
 
 static int mnlu_cb_stop(const struct nlmsghdr *nlh, void *data)
 {
-	int len = *(int *)NLMSG_DATA(nlh);
+	int len;
 
+	if (mnl_nlmsg_get_payload_len(nlh) < sizeof(len))
+		return MNL_CB_STOP;
+	len = *(int *)mnl_nlmsg_get_payload(nlh);
 	if (len < 0) {
 		errno = -len;
 		nl_dump_ext_ack_done(nlh, sizeof(int), len);
-- 
2.41.0