From: Mark Salyzyn <saly...@android.com>
Date: Thu, 23 Jul 2020 11:21:32 -0700
> Many of the nla_get_* inlines fail to check attribute's length before
> copying the content resulting in possible out-of-boundary accesses.
> Adjust the inlines to perform nla_len checking, for the most part
> using the nla_memcpy function to faciliate since these are not
> necessarily performance critical and do not need a likely fast path.
>
> Signed-off-by: Mark Salyzyn <saly...@android.com>
> Cc: netdev@vger.kernel.org
> Cc: linux-ker...@vger.kernel.org
> Cc: kernel-t...@android.com
> Cc: "David S. Miller" <da...@davemloft.net>
> Cc: Jakub Kicinski <k...@kernel.org>
> Cc: Thomas Graf <tg...@suug.ch>
> Fixes: bfa83a9e03cf ("[NETLINK]: Type-safe netlink messages/attributes
> interface")
Please, let's avoid stuff like this.
Now it is going to be expensive to move several small attributes,
which is common. And there's a multiplier when dumping, for example,
thousands of networking devices, routes, or whatever, and all of their
attributes in a dump.
If you can document actual out of bounds accesses, let's fix them. Usually
contextually the attribute type and size has been validated by the time we
execute these accessors.
I'm not applying this, sorry.
