rtnetlink: Align RTA_MULTIPATH length validation in nlattr_get

[pouria]

Summary

Fix length validation of RTA_MULTIPATH attributes in
nlattr_get_multipath() by making sure the user request is align.

PR: 295102
Reported by: Robert Morris <[e-mail]>
Fixes: 7e5bf68495cc ("netlink: add netlink support")
MFC after: 3 days

Test Plan

See the attached patch in PR295102.
https://bugs.freebsd.org/bugzilla/attachment.cgi?id=270516

[markj]

sys/netlink/route/rt.c

484

Are you sure that NL_ITEM_ALIGN() won't cause the value to wrap around, e.g., if rtnh->rtnh_len == 0xffff? I suspect we should also check NL_ITEM_ALIGN(rtnh->rtnh_len) >= rtnh->rtnh_len.

490

Here I guess we're assuming that nl_parse_header() isn't going to modify *rtnh, even though the first parameter is not a pointer to const? It would be nice if this code actually used the const qualifier.

497–498

It might be a bit cleaner to assign len at the beginning of the loop.

[pouria]

@markj you're absolutely right. my mistake.
Thank you!

[pouria]

sys/netlink/route/rt.c

490

I'll work on it in another revision.

[markj]

It would be great to add another regression test for this. I suspect that a KASAN kernel would panic if given Robert's original test case, but I haven't tried it.

sys/netlink/route/rt.c

490

Thanks!