netdev - [PATCH bpf-next] bpf: use nla_ok() instead of checking nla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 18 Dec 2023 15:19:04 -0800
From: Jakub Kicinski <kuba@...nel.org>
To: ast@...nel.org
Cc: netdev@...r.kernel.org,
	Jakub Kicinski <kuba@...nel.org>,
	syzbot+f43a23b6e622797c7a28@...kaller.appspotmail.com,
	martin.lau@...ux.dev,
	daniel@...earbox.net,
	john.fastabend@...il.com,
	andrii@...nel.org,
	song@...nel.org,
	yonghong.song@...ux.dev,
	kpsingh@...nel.org,
	sdf@...gle.com,
	haoluo@...gle.com,
	jolsa@...nel.org,
	keescook@...omium.org,
	bpf@...r.kernel.org
Subject: [PATCH bpf-next] bpf: use nla_ok() instead of checking nla_len directly

nla_len may also be too short to be sane, in which case after
recent changes nla_len() will return a wrapped value.

Reported-by: syzbot+f43a23b6e622797c7a28@...kaller.appspotmail.com
Fixes: 172db56d90d2 ("netlink: Return unsigned value for nla_len()")
Signed-off-by: Jakub Kicinski <kuba@...nel.org>
---
CC: martin.lau@...ux.dev
CC: daniel@...earbox.net
CC: john.fastabend@...il.com
CC: ast@...nel.org
CC: andrii@...nel.org
CC: song@...nel.org
CC: yonghong.song@...ux.dev
CC: kpsingh@...nel.org
CC: sdf@...gle.com
CC: haoluo@...gle.com
CC: jolsa@...nel.org
CC: keescook@...omium.org
CC: bpf@...r.kernel.org
---
 net/core/filter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 6d89a9cf33c9..24061f29c9dd 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -203,7 +203,7 @@ BPF_CALL_3(bpf_skb_get_nlattr_nest, struct sk_buff *, skb, u32, a, u32, x)
 		return 0;
 
 	nla = (struct nlattr *) &skb->data[a];
-	if (nla->nla_len > skb->len - a)
+	if (!nla_ok(nla, skb->len - a))
 		return 0;
 
 	nla = nla_find_nested(nla, x);
-- 
2.43.0