• Eric Dumazet's avatar
    rtnetlink: fix rtnl_valid_stats_req() nlmsg_len check · 69f23a09
    Eric Dumazet authored
    Jakub forgot to either use nlmsg_len() or nlmsg_msg_size(),
    allowing KMSAN to detect a possible uninit-value in rtnl_stats_get
    
    BUG: KMSAN: uninit-value in rtnl_stats_get+0x6d9/0x11d0 net/core/rtnetlink.c:4997
    CPU: 0 PID: 10428 Comm: syz-executor034 Not tainted 5.1.0-rc2+ #24
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x173/0x1d0 lib/dump_stack.c:113
     kmsan_report+0x131/0x2a0 mm/kmsan/kmsan.c:619
     __msan_warning+0x7a/0xf0 mm/kmsan/kmsan_instr.c:310
     rtnl_stats_get+0x6d9/0x11d0 net/core/rtnetlink.c:4997
     rtnetlink_rcv_msg+0x115b/0x1550 net/core/rtnetlink.c:5192
     netlink_rcv_skb+0x431/0x620 net/netlink/af_netlink.c:2485
     rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5210
     netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
     netlink_unicast+0xf3e/0x1020 net/netlink/af_netlink.c:1336
     netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1925
     sock_sendmsg_nosec net/socket.c:622 [inline]
     sock_sendmsg net/socket.c:632 [inline]
     ___sys_sendmsg+0xdb3/0x1220 net/socket.c:2137
     __sys_sendmsg net/socket.c:2175 [inline]
     __do_sys_sendmsg net/socket.c:2184 [inline]
     __se_sys_sendmsg+0x305/0x460 net/socket.c:2182
     __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2182
     do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
     entry_SYSCALL_64_after_hwframe+0x63/0xe7
    
    Fixes: 51bc860d ("rtnetlink: stats: validate attributes in get as well as dumps")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Cc: Jakub Kicinski <jakub.kicinski@netronome.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    69f23a09
rtnetlink.c 127 KB