• Kees Cook's avatar
    netlink: Bounds-check struct nlmsgerr creation · 710d21fd
    Kees Cook authored
    In preparation for FORTIFY_SOURCE doing bounds-check on memcpy(),
    switch from __nlmsg_put to nlmsg_put(), and explain the bounds check
    for dealing with the memcpy() across a composite flexible array struct.
    Avoids this future run-time warning:
    
      memcpy: detected field-spanning write (size 32) of single field "&errmsg->msg" at net/netlink/af_netlink.c:2447 (size 16)
    
    Cc: Jakub Kicinski <kuba@kernel.org>
    Cc: Pablo Neira Ayuso <pablo@netfilter.org>
    Cc: Jozsef Kadlecsik <kadlec@netfilter.org>
    Cc: Florian Westphal <fw@strlen.de>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Paolo Abeni <pabeni@redhat.com>
    Cc: syzbot <syzkaller@googlegroups.com>
    Cc: netfilter-devel@vger.kernel.org
    Cc: coreteam@netfilter.org
    Cc: netdev@vger.kernel.org
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20220901071336.1418572-1-keescook@chromium.orgSigned-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    710d21fd
af_netlink.c 68.9 KB