Skip to content

Commit

Permalink
libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
Browse files Browse the repository at this point in the history
The code assumes that everything that comes after nlmsgerr are nlattrs.
When calculating their size, it does not account for the initial
nlmsghdr. This may lead to accessing uninitialized memory.

Fixes: bbf48c1 ("libbpf: add error reporting in XDP")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com
  • Loading branch information
Ilya Leoshkevich authored and Andrii Nakryiko committed Feb 10, 2023
1 parent 202702e commit 17bcd27
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion tools/lib/bpf/nlattr.c
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh)
hlen += nlmsg_len(&err->msg);

attr = (struct nlattr *) ((void *) err + hlen);
alen = nlh->nlmsg_len - hlen;
alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;

if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen,
extack_policy) != 0) {
Expand Down

0 comments on commit 17bcd27

Please sign in to comment.