| Message ID | 20241114-fix-netlink_ack_tlv_fill-v1-1-47798af4ac96@iiitd.ac.in (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Add string check in netlink_ack_tlv_fill | expand |
> [PATCH] Add string check in netlink_ack_tlv_fill Please specify the target tree and add prefix like [PATCH net v2] netlink: Add string... We use net.git for fixes and net-next.git for others. https://www.kernel.org/doc/html/v6.11-rc6/process/maintainer-netdev.html From: Manas via B4 Relay <devnull+manas18244.iiitd.ac.in@kernel.org> Date: Thu, 14 Nov 2024 04:14:25 +0530 > From: Manas <manas18244@iiitd.ac.in> > > netlink_ack_tlv_fill crashes when in_skb->data is an empty string. This > adds a check to prevent it. > Fixes: tag is needed here. > Reported-by: syzbot+d4373fa8042c06cefa84@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=d4373fa8042c06cefa84 > Signed-off-by: Manas <manas18244@iiitd.ac.in> > --- > netlink_ack_tlv_fill crashes when in_skb->data is an empty string. This > adds a check to prevent it. You need not duplicate commit message here. under --- you can add extra info that will not be included in the actual commit, e.g. changes between each version of patches. > --- > net/netlink/af_netlink.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c > index 0a9287fadb47a2afaf0babe675738bc43051c5a7..ea205a4f81e9755a229d46a7e617ce0c090fe5e3 100644 > --- a/net/netlink/af_netlink.c > +++ b/net/netlink/af_netlink.c > @@ -2205,7 +2205,7 @@ netlink_ack_tlv_fill(struct sk_buff *in_skb, struct sk_buff *skb, > if (!err) > return; > > - if (extack->bad_attr && > + if (extack->bad_attr && strlen(in_skb->data) && > !WARN_ON((u8 *)extack->bad_attr < in_skb->data || > (u8 *)extack->bad_attr >= in_skb->data + in_skb->len)) > WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS, > > --- > base-commit: 2d5404caa8c7bb5c4e0435f94b28834ae5456623 > change-id: 20241114-fix-netlink_ack_tlv_fill-14db336fd515 > > Best regards, > -- > Manas <manas18244@iiitd.ac.in> >
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 0a9287fadb47a2afaf0babe675738bc43051c5a7..ea205a4f81e9755a229d46a7e617ce0c090fe5e3 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -2205,7 +2205,7 @@ netlink_ack_tlv_fill(struct sk_buff *in_skb, struct sk_buff *skb, if (!err) return; - if (extack->bad_attr && + if (extack->bad_attr && strlen(in_skb->data) && !WARN_ON((u8 *)extack->bad_attr < in_skb->data || (u8 *)extack->bad_attr >= in_skb->data + in_skb->len)) WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS,