On Tue, Jan 12, 2021 at 3:52 AM Xin Long <[email protected]> wrote: > > On Tue, Jan 12, 2021 at 10:56 AM Cong Wang <[email protected]> wrote: > > > > From: Cong Wang <[email protected]> > > > > fl_set_enc_opt() simply checks if there are still bytes left to parse, > > but this is not sufficent as syzbot seems to be able to generate > > malformatted netlink messages. nla_ok() is more strict so should be > > used to validate the next nlattr here. > > > > And nla_validate_nested_deprecated() has less strict check too, it is > > probably too late to switch to the strict version, but we can just > > call nla_ok() too after it. > > > > Reported-and-tested-by: > > [email protected] > > Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") > > Fixes: 79b1011cb33d ("net: sched: allow flower to match erspan options") > > Cc: Pieter Jansen van Vuuren <[email protected]> > > Cc: Jamal Hadi Salim <[email protected]> > > Cc: Xin Long <[email protected]> > > Cc: Jiri Pirko <[email protected]> > > Signed-off-by: Cong Wang <[email protected]> > > --- > > net/sched/cls_flower.c | 8 +++++--- > > 1 file changed, 5 insertions(+), 3 deletions(-) > > > > diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c > > index 1319986693fc..e265c443536e 100644 > > --- a/net/sched/cls_flower.c > > +++ b/net/sched/cls_flower.c > > @@ -1272,6 +1272,8 @@ static int fl_set_enc_opt(struct nlattr **tb, struct > > fl_flow_key *key, > > > > nla_opt_msk = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); > > msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); > > + if (!nla_ok(nla_opt_msk, msk_depth)) > > + return -EINVAL; > > } > I think it's better to also add NL_SET_ERR_MSG(extack, xxxx); > for this error return, like all the other places in this function.
I think ext message is primarily for end users who usually can not generate malformat netlink messages. On the other hand, the nla_validate_nested_deprecated() right above the quoted code does not set ext message either. Thanks.
