Patch "bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-add-length-check-for-sk_diag_bpf_storage_req_map.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 310e656bb160d6e96c94f398a5226cff19d486e2
Author: Lin Ma <linma@xxxxxxxxxx>
Date:   Tue Jul 25 10:33:30 2023 +0800

    bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
    
    [ Upstream commit bcc29b7f5af6797702c2306a7aacb831fc5ce9cb ]
    
    The nla_for_each_nested parsing in function bpf_sk_storage_diag_alloc
    does not check the length of the nested attribute. This can lead to an
    out-of-attribute read and allow a malformed nlattr (e.g., length 0) to
    be viewed as a 4 byte integer.
    
    This patch adds an additional check when the nlattr is getting counted.
    This makes sure the latter nla_get_u32 can access the attributes with
    the correct length.
    
    Fixes: 1ed4d92458a9 ("bpf: INET_DIAG support in bpf_sk_storage")
    Suggested-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Lin Ma <linma@xxxxxxxxxx>
    Reviewed-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230725023330.422856-1-linma@xxxxxxxxxx
    Signed-off-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
index 94374d529ea42..ad01b1bea52e4 100644
--- a/net/core/bpf_sk_storage.c
+++ b/net/core/bpf_sk_storage.c
@@ -531,8 +531,11 @@ bpf_sk_storage_diag_alloc(const struct nlattr *nla_stgs)
 		return ERR_PTR(-EPERM);
 
 	nla_for_each_nested(nla, nla_stgs, rem) {
-		if (nla_type(nla) == SK_DIAG_BPF_STORAGE_REQ_MAP_FD)
+		if (nla_type(nla) == SK_DIAG_BPF_STORAGE_REQ_MAP_FD) {
+			if (nla_len(nla) != sizeof(u32))
+				return ERR_PTR(-EINVAL);
 			nr_maps++;
+		}
 	}
 
 	diag = kzalloc(struct_size(diag, maps, nr_maps), GFP_KERNEL);