lkml.org 
[lkml]   [2018]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: KASAN: stack-out-of-bounds Read in __nla_put
On Thu, Jan 18, 2018 at 12:59 AM, David Ahern <dsahern@gmail.com> wrote:
> On 1/17/18 2:39 AM, Xin Long wrote:
>> I guess you need to move up your memset(0) a little bit:
>>
>> @@ -2427,6 +2443,7 @@ int netlink_rcv_skb(struct sk_buff *skb, int
>> (*cb)(struct sk_buff *,
>> nlh = nlmsg_hdr(skb);
>> err = 0;
>>
>> + memset(&extack, 0, sizeof(extack));
>> if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
>> return 0;
>>
>> @@ -2438,7 +2455,6 @@ int netlink_rcv_skb(struct sk_buff *skb, int
>> (*cb)(struct sk_buff *,
>> if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
>> goto ack;
>>
>> - memset(&extack, 0, sizeof(extack));
>> err = cb(skb, nlh, &extack);
>>
>> So that 'goto ack's won't skip it. :-)
>>
>
> you are correct. Can you submit a patch to do that?
>
sure, if you wish.

\
 
 \ /
  Last update: 2018-01-18 00:21    [W:0.043 / U:19.040 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site