From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4F33C4167B for ; Mon, 11 Dec 2023 09:40:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234639AbjLKJkY convert rfc822-to-8bit (ORCPT ); Mon, 11 Dec 2023 04:40:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234598AbjLKJkQ (ORCPT ); Mon, 11 Dec 2023 04:40:16 -0500 Received: from eu-smtp-delivery-151.mimecast.com (eu-smtp-delivery-151.mimecast.com [185.58.86.151]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4400126 for ; Mon, 11 Dec 2023 01:40:21 -0800 (PST) Received: from AcuMS.aculab.com (156.67.243.121 [156.67.243.121]) by relay.mimecast.com with ESMTP with both STARTTLS and AUTH (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id uk-mta-251-ceEQz8YcNQinqR1vFYLgmA-1; Mon, 11 Dec 2023 09:40:18 +0000 X-MC-Unique: ceEQz8YcNQinqR1vFYLgmA-1 Received: from AcuMS.Aculab.com (10.202.163.6) by AcuMS.aculab.com (10.202.163.6) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Mon, 11 Dec 2023 09:39:57 +0000 Received: from AcuMS.Aculab.com ([::1]) by AcuMS.aculab.com ([::1]) with mapi id 15.00.1497.048; Mon, 11 Dec 2023 09:39:57 +0000 From: David Laight To: 'Kees Cook' , Jakub Kicinski CC: kernel test robot , "David S . Miller" , Eric Dumazet , Paolo Abeni , Johannes Berg , Jeff Johnson , Michael Walle , Max Schulze , "netdev@vger.kernel.org" , "linux-wireless@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "linux-hardening@vger.kernel.org" Subject: RE: [PATCH v3] netlink: Return unsigned value for nla_len() Thread-Topic: [PATCH v3] netlink: Return unsigned value for nla_len() Thread-Index: AQHaKIcLTIYg1qNNHkOXUp+SE3zDFLCj2bDQ Date: Mon, 11 Dec 2023 09:39:57 +0000 Message-ID: <72800762d59a4a61ad1999dd5b816e00@AcuMS.aculab.com> References: <20231206205904.make.018-kees@kernel.org> In-Reply-To: <20231206205904.make.018-kees@kernel.org> Accept-Language: en-GB, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.202.205.107] MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: aculab.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Kees Cook > Sent: 06 December 2023 20:59 > > The return value from nla_len() is never expected to be negative, and can > never be more than struct nlattr::nla_len (a u16). Adjust the prototype > on the function. This will let GCC's value range optimization passes > know that the return can never be negative, and can never be larger than > u16. As recently discussed[1], this silences the following warning in > GCC 12+: > ... > -static inline int nla_len(const struct nlattr *nla) > +static inline u16 nla_len(const struct nlattr *nla) > { > return nla->nla_len - NLA_HDRLEN; > } It also adds an explicit mask with 0xffff. I suspect that returning 'unsigned int' will silence the warning from gcc (since the error message has a huge max size). If the value is too small copying ~64k or ~4G will both overflow the buffer. The former might (just) be exploitable, the latter will crash (so is probably better!) David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)