Re: old NLMSG_OK fix

["David S. Miller" <davem@xxxxxxxxxx>]

On Mon, 28 Jun 2004 19:43:37 +1000
Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> wrote:

> David S. Miller <davem@xxxxxxxxxx> wrote:
> > On Sun, 27 Jun 2004 19:15:52 +0200
> > Christoph Hellwig <hch@xxxxxx> wrote:
> > 
> >> http://oss.sgi.com/projects/netdev/archive/2000-09/msg00001.html
> > 
> > It works because there is always 16 bytes of scratch at the end of an
> > SKB more than was allocated for the actual data.  So blindly deref'ing
> > the nlmsg_len value is fine here.
> 
> Yes but this is also used by user-space appliations where this scratch
> space may not exist.  NETLINK messages can travel from one application
> to another so exploits are possible.

You're right, thanks for pointing this out.  I'll add it to my tree.