From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stephen Hemminger <stephen@networkplumber.org>
Subject: Re: [PATCH iproute2] iproute2: fix use-after-free
Date: Thu, 13 Sep 2018 08:19:48 -0700
Message-ID: <20180913081948.1bf8368b@xeon-e3>
References: <20180912232928.166085-1-mahesh@bandewar.net>
        <20180912173320.68048381@xeon-e3>
        <CAF2d9jgpN0T+BuMTk9GwNKVEcmH2V_yC8R=WvWYCZ95E_pkfwg@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Mahesh Bandewar <mahesh@bandewar.net>,
        netdev <netdev@vger.kernel.org>
To: "Mahesh Bandewar (=?UTF-8?B?4KSu4KS54KWH4KS2IOCkrOCkguCkoeClh+CktQ==?=
        =?UTF-8?B?4KS+4KSw?=)" <maheshb@google.com>
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-pl1-f195.google.com ([209.85.214.195]:47047 "EHLO
        mail-pl1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1726824AbeIMU3z (ORCPT
        <rfc822;netdev@vger.kernel.org>); Thu, 13 Sep 2018 16:29:55 -0400
Received: by mail-pl1-f195.google.com with SMTP id t19-v6so2729977ply.13
        for <netdev@vger.kernel.org>; Thu, 13 Sep 2018 08:19:57 -0700 (PDT)
In-Reply-To: <CAF2d9jgpN0T+BuMTk9GwNKVEcmH2V_yC8R=WvWYCZ95E_pkfwg@mail.gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On Wed, 12 Sep 2018 23:07:20 -0700
Mahesh Bandewar (=E0=A4=AE=E0=A4=B9=E0=A5=87=E0=A4=B6 =E0=A4=AC=E0=A4=82=E0=
=A4=A1=E0=A5=87=E0=A4=B5=E0=A4=BE=E0=A4=B0) <maheshb@google.com> wrote:

> On Wed, Sep 12, 2018 at 5:33 PM, Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > On Wed, 12 Sep 2018 16:29:28 -0700
> > Mahesh Bandewar <mahesh@bandewar.net> wrote:
> > =20
> > > From: Mahesh Bandewar <maheshb@google.com>
> > >
> > > A local program using iproute2 lib pointed out the issue and looking
> > > at the code it is pretty obvious -
> > >
> > >     a =3D (struct nlmsghdr *)b;
> > >     ...
> > >     free(b);
> > >     if (a->nlmsg_seq =3D=3D seq)
> > >     ...
> > >
> > > Fixes: 86bf43c7c2fd ("lib/libnetlink: update rtnl_talk to support mal=
loc buff at run time")
> > > Signed-off-by: Mahesh Bandewar <maheshb@google.com> =20
> >
> > Yes, this is a real problem.
> >
> > Maybe a minimal patch like this would be enough: =20
> actually that will leave the memory leak at the 'goto next' line (just
> few lines below) since that jump will overwrite the buf.

It looks like everytime in the while loop. a new buffer is allocated.
So yes, it looks like old, my patch, and your patch would leak there
was an error followed by other data in response.
Though I doubt kernel would ever do that.

The only user of iov style messages to the kernel is in tc batching.
My gut feeling is that if one message in batch has error, then
the netlink code should return that error and stop processing more.