BROKEN Re: [PATCH] netlink: 2-clause nla_ok()

David, please do

    git revert 4f7df337fe79bba1e4c2d525525d63b5ba186bbd

I'm an idiot.

All rationale in the commit would be correct if reading "nla_len" didn't require memory access. But it does.

    return rem >= (int)sizeof(*nla) &&
               nla->nla_len >= sizeof(*nla) &&
               nla->nla_len <= remaining;

Those logical ands ensure that memory access is not done if "rem" is small enough to even fetch ->nla_len.

Maybe someone could vouch that other checks prevent this kind of situation from happening but not me. How very embarrassing.

No, now that you spell it out (and I see the patch) - this is absolutely needed because nla_for_each_attr() [1] can be called on arbitrary data coming from userspace in a message, e.g. by way of nla_for_each_nested(). Even if it's not malformed, nla_ok() is the only abort condition for that loop, so it would read at least one nla_len after the real buffer without that condition.

johannes

[1] which seems to be the only significant user thereof

Commit 4f7df337fe79bba1e4c2d525525d63b5ba186bbd
"netlink: 2-clause nla_ok()" is BROKEN.

First clause tests if "->nla_len" could even be accessed at all, it can not possibly be omitted.

---

 include/net/netlink.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -698,7 +698,8 @@ static inline int nla_len(const struct nlattr *nla)
  */
 static inline int nla_ok(const struct nlattr *nla, int remaining)
 {
-	return nla->nla_len >= sizeof(*nla) &&
+	return remaining >= (int) sizeof(*nla) &&
+	       nla->nla_len >= sizeof(*nla) &&
 	       nla->nla_len <= remaining;
 }
 

From: Alexey Dobriyan <[email protected]>
Date: Tue, 13 Dec 2016 22:30:15 +0300

Applied, thanks.