From patchwork Wed Mar 14 14:03:22 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Potapenko X-Patchwork-Id: 885804 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="ey4gdU3B"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 401YNW6QRBz9sTw for ; Thu, 15 Mar 2018 01:03:39 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751657AbeCNOD3 (ORCPT ); Wed, 14 Mar 2018 10:03:29 -0400 Received: from mail-wr0-f196.google.com ([209.85.128.196]:40345 "EHLO mail-wr0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751302AbeCNOD2 (ORCPT ); Wed, 14 Mar 2018 10:03:28 -0400 Received: by mail-wr0-f196.google.com with SMTP id s12so2353921wre.7 for ; Wed, 14 Mar 2018 07:03:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=Tgn/2hhbltAUmr6rr1ncELntj3PGihU/flVae0AgJTM=; b=ey4gdU3BkUeFtQIY5UK9PDKF2YizUrrkfUveDLJcwkEXTrVi8TvIoD7CXbzOO5pA8a TMhkiG16y2W7GdzEzLwORyRsKszELOnn0M9vLkqW0ln5Vm53Nh7BjW+LR4qdU2d5LAqy ZjBAFF4KcD90x3u/+KmQeGGAWpNzFipO4b7rLDHnvhOPUxNp9xh949NxNhSyDUE8csyO igCXUeegIRfWx/rabAXFoW4h0MWcWRYBY3VgXAOVbvzu5yecKALc/ieul/Ac5h61JXBm Q7TzUe2Ox0VEqha2VAQtPyZnIdFVCb7NVuVHCXXcQkKFFO6Zspb3VP6o50m9nGE4qhej 8ikA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=Tgn/2hhbltAUmr6rr1ncELntj3PGihU/flVae0AgJTM=; b=ST00wMDEB0AxFa1/v4ge86dcM+vYbCedhBaO6+gIiomySQRuqDxEoEXR15mrMyf5ac t84xR41b6UqtXw4XW0h/65MWc4QCLzhB+KTO5nTLh54ZpJvDhOAlx7oFuzZJEBmXYGbr P+uGUj6CJ8HQv1z3v3mVpqw3/LTA1FUllwcAtXHAIIRs6LuZeL//9PP9PnvQlzqkRmwp 4e30+WzRfr6IV019N9mgfE5xuDtMto2ksOyGJn64vAYsVHdjOed6FmWEouGznim3NnX0 HkQHUtW6FonRVrciwRyHXipKJRZysu29s4iv/yeKkPdVa3Ri0FUEG8duvsY63FBi+ueu 2AjA== X-Gm-Message-State: AElRT7F0I1IMoZnCYF3Nf8sjC7ZogC2Oe3cFt/YeDlng6uw1HXfXtkLK mZHZm3JKtwp3b13Yu+YAK8GV4w== X-Google-Smtp-Source: AG47ELuPhcxT7XvJg5ANJ4y2B1qioql2cy66neXa7s6euZ/1dSUnyt5e3qmYGN/arzm2rtUXfgBHcA== X-Received: by 10.223.184.88 with SMTP id u24mr3780927wrf.3.1521036206436; Wed, 14 Mar 2018 07:03:26 -0700 (PDT) Received: from glider0.muc.corp.google.com ([2a00:79e0:15:10:e0c7:92b9:c022:f69b]) by smtp.gmail.com with ESMTPSA id 198sm2947913wmg.8.2018.03.14.07.03.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 14 Mar 2018 07:03:25 -0700 (PDT) From: Alexander Potapenko To: dvyukov@google.com, edumazet@google.com, davem@davemloft.net Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] netlink: make sure nladdr has correct size in netlink_connect() Date: Wed, 14 Mar 2018 15:03:22 +0100 Message-Id: <20180314140322.233047-1-glider@google.com> X-Mailer: git-send-email 2.16.2.804.g6dcf76e118-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org KMSAN reports use of uninitialized memory in the case when |alen| is smaller than sizeof(struct netlink_sock), and therefore |nladdr| isn't fully copied from the userspace. Signed-off-by: Alexander Potapenko Fixes: 1da177e4c3f41524 ("Linux-2.6.12-rc2") --- net/netlink/af_netlink.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 07e8478068f0..5d49b39e81c3 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1085,6 +1085,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, if (addr->sa_family != AF_NETLINK) return -EINVAL; + if (alen < sizeof(struct netlink_sock)) + return -EINVAL; + if ((nladdr->nl_groups || nladdr->nl_pid) && !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) return -EPERM;