From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7EA35BA49 for ; Tue, 7 Mar 2023 18:51:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF481C4339C; Tue, 7 Mar 2023 18:51:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1678215069; bh=m8kiFtJgx9JPTdnnnuVKvNQyyjMbFQ1Kwjo9Q3Ppt18=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qslLh4/2j36TpYbcj18n1KpxsXq51vvXtuGj/GHZK7HAOkdPy6Fk8tNNrPMzh93bq uw1ty4hVRLoQ8ciUL6GjOPs31acYbggHqrB7Jhb794qUWpY83qPn+sDQXCultZcM/U 4gIf4no61VAdg41D2V9DH9nR9lE8Dr5a3Fe72OXY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ilya Leoshkevich , Andrii Nakryiko , Sasha Levin Subject: [PATCH 5.15 141/567] libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() Date: Tue, 7 Mar 2023 17:57:57 +0100 Message-Id: <20230307165912.024255810@linuxfoundation.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230307165905.838066027@linuxfoundation.org> References: <20230307165905.838066027@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Ilya Leoshkevich [ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ] The code assumes that everything that comes after nlmsgerr are nlattrs. When calculating their size, it does not account for the initial nlmsghdr. This may lead to accessing uninitialized memory. Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP") Signed-off-by: Ilya Leoshkevich Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com Signed-off-by: Sasha Levin --- tools/lib/bpf/nlattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c index f57e77a6e40fd..2dbe7b99f28f1 100644 --- a/tools/lib/bpf/nlattr.c +++ b/tools/lib/bpf/nlattr.c @@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh) hlen += nlmsg_len(&err->msg); attr = (struct nlattr *) ((void *) err + hlen); - alen = nlh->nlmsg_len - hlen; + alen = (void *)nlh + nlh->nlmsg_len - (void *)attr; if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen, extack_policy) != 0) { -- 2.39.2