[PATCH] Fix attribute list size in do_get_nl_link()

* [PATCH] Fix attribute list size in do_get_nl_link()
@ 2020-11-17 14:42 Mark Jonas
  2020-11-17 14:54 ` Marc Kleine-Budde
  0 siblings, 1 reply; 4+ messages in thread
From: Mark Jonas @ 2020-11-17 14:42 UTC (permalink / raw)
  To: mkl; +Cc: linux-can, Wang Xin, Mark Jonas

From: Wang Xin <xin.wang7@cn.bosch.com>

The function do_get_nl_link() retrieves attributes from the response
RTM_NEWLINK. But it calculates the attribute list size with the wrong
structure struct ifaddrmsg. According to man 7 rtnetlink, RTM_NEWLINK
message uses struct ifinfomsg instead of struct ifaddrmsg.  This causes
that additional 8 bytes are parsed and garbage attributes might be
retrieved. One of consequences is that the message will be dropped if
the garbage attribute is IFLA_IFNAME and contains an invalid interface
name.

To fix this issue, use struct ifinfomsg to calculate the size of
attribute list for RTM_NEWLINK.

Signed-off-by: Wang Xin <xin.wang7@cn.bosch.com>
Signed-off-by: Mark Jonas <mark.jonas@de.bosch.com>
---
 src/libsocketcan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libsocketcan.c b/src/libsocketcan.c
index c802849..60142cc 100644
--- a/src/libsocketcan.c
+++ b/src/libsocketcan.c
@@ -411,7 +411,7 @@ static int do_get_nl_link(int fd, __u8 acquire, const char *name, void *res)
 			struct rtattr *tb[IFLA_MAX + 1];
 
 			len =
-				nl_msg->nlmsg_len - NLMSG_LENGTH(sizeof(struct ifaddrmsg));
+				nl_msg->nlmsg_len - NLMSG_LENGTH(sizeof(struct ifinfomsg));
 			parse_rtattr(tb, IFLA_MAX, IFLA_RTA(ifi), len);
 
 			/* Finish process if the reply message is matched */
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread