On Tue, Jan 12, 2021 at 6:22 PM Xin Long <[email protected]> wrote: > > On Wed, Jan 13, 2021 at 1:43 AM Cong Wang <[email protected]> wrote: > > > > On Tue, Jan 12, 2021 at 3:52 AM Xin Long <[email protected]> wrote: > > > > > > On Tue, Jan 12, 2021 at 10:56 AM Cong Wang <[email protected]> > > > wrote: > > > > > > > > From: Cong Wang <[email protected]> > > > > > > > > fl_set_enc_opt() simply checks if there are still bytes left to parse, > > > > but this is not sufficent as syzbot seems to be able to generate > > > > malformatted netlink messages. nla_ok() is more strict so should be > > > > used to validate the next nlattr here. > > > > > > > > And nla_validate_nested_deprecated() has less strict check too, it is > > > > probably too late to switch to the strict version, but we can just > > > > call nla_ok() too after it. > > > > > > > > Reported-and-tested-by: > > > > [email protected] > > > > Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") > > > > Fixes: 79b1011cb33d ("net: sched: allow flower to match erspan options") > > > > Cc: Pieter Jansen van Vuuren <[email protected]> > > > > Cc: Jamal Hadi Salim <[email protected]> > > > > Cc: Xin Long <[email protected]> > > > > Cc: Jiri Pirko <[email protected]> > > > > Signed-off-by: Cong Wang <[email protected]> > > > > --- > > > > net/sched/cls_flower.c | 8 +++++--- > > > > 1 file changed, 5 insertions(+), 3 deletions(-) > > > > > > > > diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c > > > > index 1319986693fc..e265c443536e 100644 > > > > --- a/net/sched/cls_flower.c > > > > +++ b/net/sched/cls_flower.c > > > > @@ -1272,6 +1272,8 @@ static int fl_set_enc_opt(struct nlattr **tb, > > > > struct fl_flow_key *key, > > > > > > > > nla_opt_msk = > > > > nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); > > > > msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); > > > > + if (!nla_ok(nla_opt_msk, msk_depth)) > > > > + return -EINVAL; > > > > } > > > I think it's better to also add NL_SET_ERR_MSG(extack, xxxx); > > > for this error return, like all the other places in this function. > > > > I think ext message is primarily for end users who usually can not > > generate malformat netlink messages. > > > > On the other hand, the nla_validate_nested_deprecated() right above > > the quoted code does not set ext message either. > nla_validate_nested_deprecated(..., extack), it's already done inside > when returns error, no?
Yeah, seems fair. Thanks.
