Re: [net] tipc: fix uninit-value in tipc_nl_node_reset_link_stats

[Jakub Kicinski <kuba@kernel.org>]

On Wed,  6 Jul 2022 10:47:52 +0700 Hoang Le wrote:
> diff --git a/net/tipc/node.c b/net/tipc/node.c
> index b48d97cbbe29..80885780caa2 100644
> --- a/net/tipc/node.c
> +++ b/net/tipc/node.c
> @@ -2574,8 +2574,10 @@ int tipc_nl_node_reset_link_stats(struct sk_buff *skb, struct genl_info *info)
>  	if (!attrs[TIPC_NLA_LINK_NAME])
>  		return -EINVAL;
>  
> -	link_name = nla_data(attrs[TIPC_NLA_LINK_NAME]);
> +	if (nla_len(attrs[TIPC_NLA_LINK_NAME]) <= 0)
> +		return -EINVAL;
>  
> +	link_name = nla_data(attrs[TIPC_NLA_LINK_NAME]);
>  	err = -EINVAL;
>  	if (!strcmp(link_name, tipc_bclink_name)) {
>  		err = tipc_bclink_reset_stats(net, tipc_bc_sndlink(net));

I think you misunderstood me. Let me try to explain in more detail.

AFAICT the attrs in this function get validated using the
tipc_nl_link_policy:

https://elixir.bootlin.com/linux/v5.19-rc4/source/net/tipc/node.c#L2567

This policy specifies the type for TIPC_NLA_LINK_NAME as NLA_STRING:

https://elixir.bootlin.com/linux/v5.19-rc4/source/net/tipc/netlink.c#L91

Therefore we can assume that the attribute is a valid (but not
necessarily null-terminated) string. Otherwise
nla_parse_nested_deprecated() would have returned an error.

The code for NLA_STRING validation is here:

https://elixir.bootlin.com/linux/v5.19-rc4/source/lib/nlattr.c#L437

So we can already assume that the attribute is not empty.

The bug you're fixing is that the string is not null-terminated, 
so strcmp() can read past the end of the attribute.

What I was trying to suggest is that you change the policy from
NLA_STRING to NLA_NUL_STRING, which also checks that the string 
is NULL-terminated.

Please note that it'd be a slight uAPI change, and could break
applications which expect kernel to not require null-termination.
Perhaps tipc developers can guide us on how likely that is.
Alternative is to use strncmp(..., nla_len(attr)).