Received: by 2002:ac0:a5b6:0:0:0:0:0 with SMTP id m51-v6csp303606imm; Fri, 1 Jun 2018 00:51:24 -0700 (PDT) X-Google-Smtp-Source: ADUXVKKPqg/fW//IWxl+G4QwDL70uArQbe1Z8SJe8RtCOncZXjjXAZ/jyHK20mIpml/uUSfiMOvJ X-Received: by 2002:a17:902:7b95:: with SMTP id w21-v6mr6560875pll.255.1527839484605; Fri, 01 Jun 2018 00:51:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1527839484; cv=none; d=google.com; s=arc-20160816; b=oWklUO7WaDdOkvkx3IGCwMpYbNhVyaw7KGHeQuogKskt2VP7s7hX3FVhXWabALrVAP ol5TJ2FdobT/auz8jOBCZEWQ+cUCt/vOqurqMHbzNzGs1iR3+/A/w+vYs+FrjjyuumW2 RpoaM6qULxVXWpGNAkLHz79qeGK4c2LEGbzUTnrbCnNQ2oDiBu64bBm6+IsAyhffl+SV sIn+iV/6o4OkyV7wN9XQO1OsRVH3nkhj5rnTzrz4ZP3UzcSSXsGsjKPx6AHydAPGEinz +3WRBB6GAkRxweES8cjw2Yr+UzlEP0iRal1dqG5/lmoTQTuNyLnp6NsuuLFokHMYOEEw Y+lA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:arc-authentication-results; bh=Q2pMKkqDrv4REeAU7jsqkhswj8xyEMkSFa8iZQSCXgU=; b=qTXnyw6B42SV/9Vl8U0k5GQ2Fm2Hp6nPqtR3BsRD27IG4Bbuu/Wwxbjhrwtuo76nzn 1JjPFQcGzzrWlSKk0jTee0G9cbzRKlc0twEaK+3U9FnDlssWQNkaW0NWtuc4s69lpmCm ATLTbYlOdYTgvKmw5MLqshMhvg/bcTIjAoLUNmktD8xg+fmIUZt65NE5vwjZRdETneEW 72yJzfl7+La5+zC6md++v+ZQsj3DWySWwfPcxlkzyhK5KRM/tucLQsiQmdpmJknuk2qk nJuA0T4nA2xCJ6ootg/BxVyDutm1cM3mc/0IzWqckV6RChQJJUJ3KqNwj/sH6w1cX7YZ i/4w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v66-v6si31303581pgv.344.2018.06.01.00.51.08; Fri, 01 Jun 2018 00:51:24 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751368AbeFAHsK (ORCPT + 99 others); Fri, 1 Jun 2018 03:48:10 -0400 Received: from mail.us.es ([193.147.175.20]:54928 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750974AbeFAHsI (ORCPT ); Fri, 1 Jun 2018 03:48:08 -0400 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 2D1E37B55D for ; Fri, 1 Jun 2018 09:46:57 +0200 (CEST) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 19966DA4C1 for ; Fri, 1 Jun 2018 09:46:57 +0200 (CEST) Received: by antivirus1-rhel7.int (Postfix, from userid 99) id 0E00FDA4D3; Fri, 1 Jun 2018 09:46:57 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on antivirus1-rhel7.int X-Spam-Level: X-Spam-Status: No, score=-108.2 required=7.5 tests=ALL_TRUSTED,BAYES_50, SMTPAUTH_US2,USER_IN_WHITELIST autolearn=disabled version=3.4.1 Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id BEB07DA737; Fri, 1 Jun 2018 09:46:54 +0200 (CEST) Received: from 192.168.1.97 (192.168.1.97) by antivirus1-rhel7.int (F-Secure/fsigk_smtp/550/antivirus1-rhel7.int); Fri, 01 Jun 2018 09:46:52 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/antivirus1-rhel7.int) Received: from us.es (sys.soleta.eu [212.170.55.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: 1984lsi) by entrada.int (Postfix) with ESMTPSA id 958B5412B6A4; Fri, 1 Jun 2018 09:46:54 +0200 (CEST) Date: Fri, 1 Jun 2018 09:48:04 +0200 X-SMTPAUTHUS: auth mail.us.es From: Pablo Neira Ayuso To: Kees Cook Cc: Jozsef Kadlecsik , Florian Westphal , "David S. Miller" , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] netfilter: nfnetlink: Remove VLA usage Message-ID: <20180601074804.44l66hj7lcwhpdmv@salvia> References: <20180530191756.GA39504@beast> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180530191756.GA39504@beast> User-Agent: NeoMutt/20170113 (1.7.2) X-Virus-Scanned: ClamAV using ClamSMTP Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 30, 2018 at 12:17:56PM -0700, Kees Cook wrote: > In the quest to remove all stack VLA usage from the kernel[1], this > allocates the maximum size expected for all possible attrs and adds > sanity-checks at both registration and usage to make sure nothing > gets out of sync. > > [1] https://lkml.kernel.org/r/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com Applied, thanks Kees.