Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751735AbdFFVPO (ORCPT ); Tue, 6 Jun 2017 17:15:14 -0400 Received: from mail-vk0-f46.google.com ([209.85.213.46]:35616 "EHLO mail-vk0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751615AbdFFVPM (ORCPT ); Tue, 6 Jun 2017 17:15:12 -0400 MIME-Version: 1.0 In-Reply-To: <20170606.163639.1246601020260541080.davem@davemloft.net> References: <20170606135654.111884-1-glider@google.com> <20170606.163639.1246601020260541080.davem@davemloft.net> From: Alexander Potapenko Date: Tue, 6 Jun 2017 23:15:11 +0200 Message-ID: Subject: Re: [PATCH v4] net: don't call strlen on non-terminated string in dev_set_alias() To: David Miller Cc: Dmitriy Vyukov , Kostya Serebryany , Eric Dumazet , stephen@networkplumber.org, LKML , Networking Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id v56LFIXD020948 Content-Length: 1240 Lines: 37 On Tue, Jun 6, 2017 at 10:36 PM, David Miller wrote: > From: Alexander Potapenko > Date: Tue, 6 Jun 2017 15:56:54 +0200 > >> KMSAN reported a use of uninitialized memory in dev_set_alias(), >> which was caused by calling strlcpy() (which in turn called strlen()) >> on the user-supplied non-terminated string. >> >> Signed-off-by: Alexander Potapenko > > We should not be allowing non-NULL terminated strings for the > IFLA_IFALIAS attribute. It's defined as type NLA_STRING in > the ifla_policy[] array. Sorry, I couldn't determine from RFC 2233 whether ifAlias is zero-terminated or not, but looking at validate_nla() I see that NLA_STRING is supposed to be such. I'll check what's going on. > Please figure out why we aren't enforcing the attribute policy > properly, rather than adding a workaround. Guess the string has been previously claimed to be non-terminated here: https://patchwork.ozlabs.org/patch/996/ > Thanks. -- Alexander Potapenko Software Engineer Google Germany GmbH Erika-Mann-Straße, 33 80636 München Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg