All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
	Roopa Prabhu <roopa@nvidia.com>,
	"David S. Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.19 23/28] rtnetlink: fix if_nlmsg_stats_size() under estimation
Date: Mon, 11 Oct 2021 15:47:13 +0200	[thread overview]
Message-ID: <20211011134641.466976541@linuxfoundation.org> (raw)
In-Reply-To: <20211011134640.711218469@linuxfoundation.org>

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit d34367991933d28bd7331f67a759be9a8c474014 ]

rtnl_fill_statsinfo() is filling skb with one mandatory if_stats_msg structure.

nlmsg_put(skb, pid, seq, type, sizeof(struct if_stats_msg), flags);

But if_nlmsg_stats_size() never considered the needed storage.

This bug did not show up because alloc_skb(X) allocates skb with
extra tailroom, because of added alignments. This could very well
be changed in the future to have deterministic behavior.

Fixes: 10c9ead9f3c6 ("rtnetlink: add new RTM_GETSTATS message to dump link stats")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Acked-by: Roopa Prabhu <roopa@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/rtnetlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 055fd09ac111..83de32e34bb5 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4512,7 +4512,7 @@ nla_put_failure:
 static size_t if_nlmsg_stats_size(const struct net_device *dev,
 				  u32 filter_mask)
 {
-	size_t size = 0;
+	size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg));
 
 	if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0))
 		size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64));
-- 
2.33.0




  parent reply	other threads:[~2021-10-11 14:16 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-11 13:46 [PATCH 4.19 00/28] 4.19.211-rc1 review Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 01/28] Partially revert "usb: Kconfig: using select for USB_COMMON dependency" Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 02/28] USB: cdc-acm: fix racy tty buffer accesses Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 03/28] USB: cdc-acm: fix break reporting Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 04/28] xen/privcmd: fix error handling in mmap-resource processing Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 05/28] ovl: fix missing negative dentry check in ovl_rename() Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 06/28] nfsd4: Handle the NFSv4 READDIR dircount hint being zero Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 07/28] xen/balloon: fix cancelled balloon action Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 08/28] ARM: dts: omap3430-sdp: Fix NAND device node Greg Kroah-Hartman
2021-10-11 13:46 ` [PATCH 4.19 09/28] ARM: dts: qcom: apq8064: use compatible which contains chipid Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 10/28] bpf, mips: Validate conditional branch offsets Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 11/28] xtensa: call irqchip_init only when CONFIG_USE_OF is selected Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 12/28] bpf, arm: Fix register clobbering in div/mod implementation Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 13/28] bpf: Fix integer overflow in prealloc_elems_and_freelist() Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 14/28] phy: mdio: fix memory leak Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 15/28] net_sched: fix NULL deref in fifo_set_limit() Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 16/28] powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 17/28] ptp_pch: Load module automatically if ID matches Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 18/28] ARM: imx6: disable the GIC CPU interface before calling stby-poweroff sequence Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 19/28] net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 20/28] net: sfp: Fix typo in state machine debug string Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 21/28] netlink: annotate data races around nlk->bound Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 22/28] drm/nouveau/debugfs: fix file release memory leak Greg Kroah-Hartman
2021-10-11 13:47 ` Greg Kroah-Hartman [this message]
2021-10-11 13:47 ` [PATCH 4.19 24/28] i40e: fix endless loop under rtnl Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 25/28] i40e: Fix freeing of uninitialized misc IRQ vector Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 26/28] i2c: acpi: fix resource leak in reconfiguration device addition Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 27/28] powerpc/bpf: Fix BPF_MOD when imm == 1 Greg Kroah-Hartman
2021-10-11 13:47 ` [PATCH 4.19 28/28] x86/Kconfig: Correct reference to MWINCHIP3D Greg Kroah-Hartman
2021-10-11 16:51 ` [PATCH 4.19 00/28] 4.19.211-rc1 review Pavel Machek
2021-10-11 20:51 ` Guenter Roeck
2021-10-12  1:18 ` Shuah Khan
2021-10-12  1:59 ` Guenter Roeck
2021-10-12  8:13 ` Samuel Zou

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211011134641.466976541@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=roopa@nvidia.com \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.