diff options
| author | Ilya Leoshkevich <iii@linux.ibm.com> | 2023-02-10 01:12:01 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-03-11 16:31:37 +0100 |
| commit | d5bdae351ad5f820033f6c174272dfe6c4b85bf0 (patch) | |
| tree | c306f2e7ffa429649d49dd729d171e71d27a781d /tools | |
| parent | a6a7d1541fefddf7ca0cfb34c1bff63ff809cc49 (diff) | |
| download | linux-stable-d5bdae351ad5f820033f6c174272dfe6c4b85bf0.tar.gz linux-stable-d5bdae351ad5f820033f6c174272dfe6c4b85bf0.tar.bz2 linux-stable-d5bdae351ad5f820033f6c174272dfe6c4b85bf0.zip | |
libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ]
The code assumes that everything that comes after nlmsgerr are nlattrs.
When calculating their size, it does not account for the initial
nlmsghdr. This may lead to accessing uninitialized memory.
Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/lib/bpf/nlattr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c index 4719434278b2..ac979b429055 100644 --- a/tools/lib/bpf/nlattr.c +++ b/tools/lib/bpf/nlattr.c @@ -170,7 +170,7 @@ int nla_dump_errormsg(struct nlmsghdr *nlh) hlen += nlmsg_len(&err->msg); attr = (struct nlattr *) ((void *) err + hlen); - alen = nlh->nlmsg_len - hlen; + alen = (void *)nlh + nlh->nlmsg_len - (void *)attr; if (nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen, extack_policy) != 0) { fprintf(stderr, |