From: Ilya Leoshkevich Date: Fri, 10 Feb 2023 00:12:01 +0000 (+0100) Subject: libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() X-Git-Tag: v6.6.7~3490^2~92^2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=17bcd27a08a21397698edf143084d7c87ce17946;p=platform%2Fkernel%2Flinux-starfive.git libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() The code assumes that everything that comes after nlmsgerr are nlattrs. When calculating their size, it does not account for the initial nlmsghdr. This may lead to accessing uninitialized memory. Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP") Signed-off-by: Ilya Leoshkevich Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com --- diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c index 3900d052ed19..975e265eab3b 100644 --- a/tools/lib/bpf/nlattr.c +++ b/tools/lib/bpf/nlattr.c @@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh) hlen += nlmsg_len(&err->msg); attr = (struct nlattr *) ((void *) err + hlen); - alen = nlh->nlmsg_len - hlen; + alen = (void *)nlh + nlh->nlmsg_len - (void *)attr; if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen, extack_policy) != 0) {