netlink: Use netlink header as base to calculate bad attribute offset

[ Upstream commit 84b3268027641401bb8ad4427a90a3cce2eb86f5 ] Userspace might send a batch that is composed of several netlink messages. The netlink_ack() function must use the pointer to the netlink header as base to calculate the bad attribute offset. Fixes: 2d4bc93 ("netlink: extended ACK reporting") Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
akeromi · Mar 18, 2020 · 7aa760f · 7aa760f
1 parent 53e404e
commit 7aa760f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
@@ -2411,7 +2411,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
 							       in_skb->len))
 				WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS,
 						    (u8 *)extack->bad_attr -
-						    in_skb->data));
+						    (u8 *)nlh));
 		} else {
 			if (extack->cookie_len)
 				WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE,