Re: [PATCH net 4/4] drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

[Hangbin Liu <hangbin.liu@linux.dev>]

On Thu, Sep 10, 2026 at 08:46:12PM +0000, Eric Dumazet wrote:
> In reset_per_cpu_data(), al is computed as:
> 
>     al = sizeof(struct net_dm_alert_msg);
>     al += dm_hit_limit * sizeof(struct net_dm_drop_point);
>     al += sizeof(struct nlattr);
> 
>     skb = genlmsg_new(al, GFP_KERNEL);
>     ...
>     nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
>     ...
>     msg = nla_data(nla);
>     memset(msg, 0, al);
> 
> Because al includes sizeof(struct nlattr) (the 4-byte attribute header),
> genlmsg_new() allocates al bytes of tailroom starting at nla.
> However, msg points to nla_data(nla), which is located
> sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)
> therefore writes al bytes starting from msg, exceeding the allocated
> buffer by sizeof(struct nlattr) (4 bytes) and corrupting
> skb_shared_info.
> 
> Fix this by letting al represent only the payload length, allocating
> the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing
> al bytes from msg.
> 
> Fixes: 683703a26e46 ("drop_monitor: Update netlink protocol to include netlink attribute header in alert message")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  net/core/drop_monitor.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
> index 795c15dd1771a2a5f15e109d0ef2eed967c45443..edc660778408e1bb996124be5a5349dfc9be3568 100644
> --- a/net/core/drop_monitor.c
> +++ b/net/core/drop_monitor.c
> @@ -141,9 +141,8 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
>  
>  	al = sizeof(struct net_dm_alert_msg);
>  	al += dm_hit_limit * sizeof(struct net_dm_drop_point);
> -	al += sizeof(struct nlattr);
>  
> -	skb = genlmsg_new(al, GFP_KERNEL);
> +	skb = genlmsg_new(nla_total_size(al), GFP_KERNEL);
>  
>  	if (!skb)
>  		goto err;
> -- 
> 2.55.0.1007.g17ff1f9808-goog
> 

Yes, nla_total_size is safer.

Reviewed-by: Hangbin Liu <liuhangbin@kylinos.cn>