Re: [PATCH] net: sched: Fix memory exposure from short TCA_U32_SEL

[Jamal Hadi Salim]

On 2018-08-26 2:19 a.m., Kees Cook wrote:
> On Sat, Aug 25, 2018 at 11:15 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
> > On Sat, Aug 25, 2018 at 10:58:01PM -0700, Kees Cook wrote:
> > Saner approach would be sel_size = offsetof(struct tc_u32_sel, keys[s->nkeys])...
>
> Either is fine by me.
>
> > > +     sel_size = struct_size(s, keys, s->nkeys);
> > > +     if (nla_len(tb[TCA_U32_SEL]) < sel_size) {
> > > +             err = -EINVAL;
> > > +             goto erridr;
> > > +     }
> > >
> > > -     n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
> > > +     n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL);
> >
> > ITYM
> >          n = kzalloc(offsetof(struct tc_u_common, sel.keys[s->nkeys]), GFP_KERNEL);
>
> I prefer to reuse sel_size and keep typeof() to keep things tied to
> "n" more directly. *shrug*

Looks good to me.
We should add an nla_policy later.

Acked-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>

cheers,
jamal