From nobody Wed Jan 29 23:49:14 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YjzQM0hMrz5mBRl; Wed, 29 Jan 2025 23:49:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YjzQL3Sw8z3CMG; Wed, 29 Jan 2025 23:49:14 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738194554; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=q/b94TzxwsYsHYdC6oDlqMHOgPnh6Uohdu6Eqqbgz5Q=; b=EmjN2CS7Z3Nbs0PZ+NcjO3hWKLgvrg4PfHwayADlTpav6KeWsI6jnO/FEBtAjsML5Dg49v vkfLe506r3/HkZ4VNVXmyFkB8hth9FNevYaucJqd1p+kAVJ/NfWB//LrX4aLw+hjnN4jPJ RbE3vduh90CcVcgHt9Jlr/LOxor7ABpTb5uwB2mAOEhckwoaZRJN/9UuI9eC9QhuxJaHkD VebqL3Kwu5RUZqvLJCluBXM+DkwVoVu2X7wohLc7mJFupWnQd+cI85fEHRq2Oid7n10VkN Z+C3rZJUL8HL7ZM1eDSBH23cm1j4ksOJqJbLpU76LIOMZhFuCLjO6yboVX5WrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738194554; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=q/b94TzxwsYsHYdC6oDlqMHOgPnh6Uohdu6Eqqbgz5Q=; b=ANNskbMm2xqFJ5OnSaK4DrsmIcCsfOtoMjAb0BLLbq4wrWBdI0Ly1gNarxFl95hTyHY8ZI VbWV3icNAeXvpJO+N2VB7S7hvgxrGVo4b+LhjK2z8vDHDeMzgLGBp+Gs95Dfck7DyfxOFe rkk8kR3zDDzZaEquRojV0zlzKHHm8qZ9dNGRWY+32YtbYgHQtTSRoMaOjVoSL6SdnKLltk KUoUqmxlZzTjjyflnhA15SmECKWrvTjvv561UROP2BmuBMxx2B3WPmERitzVZKy5iGKP3E cpZMTYQ7/SH4o7KRYDTB5WiRfEMwffwmKnBsDqJeEewN/Aa/DhdY3xUiKyUSVg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1738194554; a=rsa-sha256; cv=none; b=kPqp1QFh7pb8ayxlq0nr7Wrv0/db272wLAcenb+oEauRhZz9rXyIoBwBTW9dDtQTGytAVy lh3ucxzylBuooIgyfQ/iax6znBkJHqYw0ftJpSBR2Mz5l5uwgqai2u7RUCpksIIbcleyjX 1mE0qQpdfsSh8zetpvDs2h1OKl7N9B75mehACLSL4P283VSIb9ghXH23SCv71aAV0uixr9 4qSlorX82L6QZoP0YqtK4/FSnn+20CGoUZZ2GgG0i9uzmyoJ9sqGHtlzYqGwsBr2FX/LDe kux8HWFSoOJnxaCQox8pIjSA+wm6Y0OU0PQiGTv8mflHiHt5vrl6p12UboVsxQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YjzQL2S15z79B; Wed, 29 Jan 2025 23:49:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50TNnE9Z007254; Wed, 29 Jan 2025 23:49:14 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50TNnEaM007251; Wed, 29 Jan 2025 23:49:14 GMT (envelope-from git) Date: Wed, 29 Jan 2025 23:49:14 GMT Message-Id: <202501292349.50TNnEaM007251@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Gleb Smirnoff Subject: git: 49a6e213416b - main - netlink/route: fix nlattr_get_multipath() to check length List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: glebius X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 49a6e213416b5c0c9eccdff0af1c6b01f34c3693 Auto-Submitted: auto-generated The branch main has been updated by glebius: URL: https://cgit.FreeBSD.org/src/commit/?id=49a6e213416b5c0c9eccdff0af1c6b01f34c3693 commit 49a6e213416b5c0c9eccdff0af1c6b01f34c3693 Author: Gleb Smirnoff AuthorDate: 2025-01-29 18:22:46 +0000 Commit: Gleb Smirnoff CommitDate: 2025-01-29 23:48:55 +0000 netlink/route: fix nlattr_get_multipath() to check length of supplied nexthop sub-attributes. While here, use unsigned types for length calculations and improve style(9). PR: 283860 --- sys/netlink/route/rt.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/sys/netlink/route/rt.c b/sys/netlink/route/rt.c index 79ecd066aa72..1ee18f994c65 100644 --- a/sys/netlink/route/rt.c +++ b/sys/netlink/route/rt.c @@ -426,33 +426,45 @@ post_p_rtnh(void *_attrs, struct nl_pstate *npt __unused) NL_DECLARE_PARSER_EXT(mpath_parser, struct rtnexthop, NULL, nlf_p_rtnh, nla_p_rtnh, post_p_rtnh); struct rta_mpath { - int num_nhops; + u_int num_nhops; struct rta_mpath_nh nhops[0]; }; static int -nlattr_get_multipath(struct nlattr *nla, struct nl_pstate *npt, const void *arg, void *target) +nlattr_get_multipath(struct nlattr *nla, struct nl_pstate *npt, + const void *arg, void *target) { - int data_len = nla->nla_len - sizeof(struct nlattr); + struct rta_mpath *mp; struct rtnexthop *rtnh; + uint16_t data_len, len; + u_int max_nhops; + int error; - int max_nhops = data_len / sizeof(struct rtnexthop); + data_len = nla->nla_len - sizeof(struct nlattr); + max_nhops = data_len / sizeof(struct rtnexthop); - struct rta_mpath *mp = npt_alloc(npt, (max_nhops + 2) * sizeof(struct rta_mpath_nh)); + mp = npt_alloc(npt, (max_nhops + 2) * sizeof(struct rta_mpath_nh)); mp->num_nhops = 0; for (rtnh = (struct rtnexthop *)(nla + 1); data_len > 0; ) { - struct rta_mpath_nh *mpnh = &mp->nhops[mp->num_nhops++]; + struct rta_mpath_nh *mpnh; - int error = nl_parse_header(rtnh, rtnh->rtnh_len, &mpath_parser, + if (__predict_false(rtnh->rtnh_len <= sizeof(*rtnh) || + rtnh->rtnh_len > data_len)) { + NLMSG_REPORT_ERR_MSG(npt, "%s: bad length %u", + __func__, rtnh->rtnh_len); + return (EINVAL); + } + mpnh = &mp->nhops[mp->num_nhops++]; + error = nl_parse_header(rtnh, rtnh->rtnh_len, &mpath_parser, npt, mpnh); if (error != 0) { - NLMSG_REPORT_ERR_MSG(npt, "RTA_MULTIPATH: nexhop %d: parse failed", + NLMSG_REPORT_ERR_MSG(npt, + "RTA_MULTIPATH: nexthop %u: parse failed", mp->num_nhops - 1); return (error); } - - int len = NL_ITEM_ALIGN(rtnh->rtnh_len); + len = NL_ITEM_ALIGN(rtnh->rtnh_len); data_len -= len; rtnh = (struct rtnexthop *)((char *)rtnh + len); }