netlink: make sure nladdr has correct size in netlink_connect()
Subsystems (2)
PATCH 1/1 netlink: make sure nladdr has correct size in netlink_connect()
KMSAN reports use of uninitialized memory in the case when |alen| is smaller than sizeof(struct netlink_sock), and therefore |nladdr| isn't fully copied from the userspace.
--- net/netlink/af_netlink.c | 3 +++ 1 file changed, 3 insertions(+)
net/netlink/af_netlink.c +3 -0
@@ -1085,6 +1085,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,if (addr->sa_family !=AF_NETLINK )return -EINVAL ; +if (alen <sizeof (struct netlink_sock )) +return -EINVAL ; +if ((nladdr->nl_groups || nladdr->nl_pid) && !netlink_allowed (sock,NL_CFG_F_NONROOT_SEND ))return -EPERM ;
Signature · 1 line
2.16.2.804.g6dcf76e118-goog
Quoted 15 lines · Alexander Potapenko
KMSAN reports use of uninitialized memory in the case when |alen| is smaller than
sizeof(struct netlink_sock), and therefore |nladdr| isn't fully copied from the userspace.Signed-off-by Alexander Potapenko <[email protected]>Fixes 1da177e4c3f41524 ("Linux-2.6.12-rc2")--- net/netlink/af_netlink.c | 3 +++ 1 file changed, 3 insertions(+)net/netlink/af_netlink.c +0
-0
net/netlink/af_netlink.c static int netlink_connect(struct socket *sock, struct sockaddr *addr, · line 1091
Quoted 7 lines
net/netlink/af_netlink.c +3
-0@@ -1085,6 +1085,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,if (addr->sa_family !=AF_NETLINK )return -EINVAL ; +if (alen <sizeof (struct netlink_sock )) +return -EINVAL ; +
Hmmm. How was this patch tested exactly ?
Thanks.
A message that is not in the archive (sent off-list or not yet received): CAG_fn=VMj0KDqr24Mx71QBZjHzJDdQi0OthA-E1YcB0q=Sk0BA@mail.gmail.com
Quoted 33 lines · Alexander Potapenko
Quoted 22 lines · Eric Dumazet
Quoted 19 lines · Alexander Potapenko
KMSAN reports use of uninitialized memory in the case when |alen| is smaller than
sizeof(struct netlink_sock), and therefore |nladdr| isn't fully copied from the userspace.Signed-off-by Alexander Potapenko <[email protected]>Fixes 1da177e4c3f41524 ("Linux-2.6.12-rc2")--- net/netlink/af_netlink.c | 3 +++ 1 file changed, 3 insertions(+)net/netlink/af_netlink.c +0
-0@@ -1085,6 +1085,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, if (addr->sa_family != AF_NETLINK) return -EINVAL;Quoted 6 lines
net/netlink/af_netlink.c static int netlink_connect(struct socket *sock, struct sockaddr *addr,
Quoted 4 lines
net/netlink/af_netlink.c +3
-0+if (alen <sizeof (struct netlink_sock )) +return -EINVAL ; +Hmmm. How was this patch tested exactly ?
Quoted 4 lines
You're absolutely right, I should have been using
sizeof(sockaddr_nl). The reproducer that I used to trigger the bug was passing alen=2, so the patch still worked despite being incorrect.
Is there any generic set of networking tests that I can use for such bugs?
There are upstream tests in tools/testing/selftests/
In your case, making sure tools like iproute2 ss are still working would have done the job.