`put()` trusted an unchecked `as` cast from `usize` to `c_int`.
When the length exceeds `i32::MAX` that cast wraps around to a
negative value.
This ultimately resulted in a kernel panic when the reinterpreted
value via `__nla_reserve()` and `skb_put()` became enormous.
Validate payload and header both fit together in a `u16`, rejecting
any payload that wouldn't leave room for `NLA_HDRLEN`.
Fixes: 5eaa5fbb6e ("rust: netlink: add raw netlink abstraction")
Reviewed-by: Alice Ryhl <[email protected]>
Reviewed-by: Alexandre Courbot <[email protected]>
Reviewed-by: Carlos Llamas <[email protected]>
Reviewed-by: Gary Guo <[email protected]>
Signed-off-by: Sagar Taunk <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Paolo Abeni <[email protected]>
Sagar Taunk
0923198be4