github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

rtnetlink: use nla_nest_end_safe() in rtnl_fill_prop_list()

Browse Source 
Avoid corrupting a netlink message and confuse user space in the
very unlikely case rtnl_fill_prop_list was able to produce a very big
nested element.

This is extremely unlikely, because rtnl_prop_list_size()
provisions nla_total_size(ALTIFNAMSIZ) per altname.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260525083542.1565964-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Dumazet 2026-05-25 08:35:38 +00:00 committed by Jakub Kicinski
parent 2bcf59eefb
commit 73a7c8fb23
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/core/rtnetlink.c
View File

@ -1970,7 +1970,10 @@ static int rtnl_fill_prop_list(struct sk_buff *skb,
if (ret <= 0)
goto nest_cancel;
nla_nest_end(skb, prop_list);
ret = -EMSGSIZE;
if (nla_nest_end_safe(skb, prop_list) < 0)
goto nest_cancel;
return 0;
nest_cancel: