libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()

The code assumes that everything that comes after nlmsgerr are nlattrs.
When calculating their size, it does not account for the initial
nlmsghdr. This may lead to accessing uninitialized memory.

Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com

diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c
index 3900d052ed19ea651c314fb9205e89f495fa71c1..975e265eab3bfec5378a5c4849813dfb672ce018 100644 (file)
--- a/tools/lib/bpf/nlattr.c
+++ b/tools/lib/bpf/nlattr.c
@@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh)
                hlen += nlmsg_len(&err->msg);
 
        attr = (struct nlattr *) ((void *) err + hlen);
-       alen = nlh->nlmsg_len - hlen;
+       alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;
 
        if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen,
                             extack_policy) != 0) {