Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1235242
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.14 67/84] netlink, mmap: transform mmap skb into full skb on taps |
| Date | 2015-09-29 17:30 +0200 |
| Message-ID | <qe50T-1Za-35@gated-at.bofh.it> (permalink) |
| References | <qe4Rd-1Nk-47@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit 1853c949646005b5959c483becde86608f548f24 ]
Ken-ichirou reported that running netlink in mmap mode for receive in
combination with nlmon will throw a NULL pointer dereference in
__kfree_skb() on nlmon_xmit(), in my case I can also trigger an "unable
to handle kernel paging request". The problem is the skb_clone() in
__netlink_deliver_tap_skb() for skbs that are mmaped.
I.e. the cloned skb doesn't have a destructor, whereas the mmap netlink
skb has it pointed to netlink_skb_destructor(), set in the handler
netlink_ring_setup_skb(). There, skb->head is being set to NULL, so
that in such cases, __kfree_skb() doesn't perform a skb_release_data()
via skb_release_all(), where skb->head is possibly being freed through
kfree(head) into slab allocator, although netlink mmap skb->head points
to the mmap buffer. Similarly, the same has to be done also for large
netlink skbs where the data area is vmalloced. Therefore, as discussed,
make a copy for these rather rare cases for now. This fixes the issue
on my and Ken-ichirou's test-cases.
Reference: http://thread.gmane.org/gmane.linux.network/371129
Fixes: bcbde0d449ed ("net: netlink: virtual tap device management")
Reported-by: Ken-ichirou MATSUZAWA <chamaken@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Ken-ichirou MATSUZAWA <chamaken@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlink/af_netlink.c | 30 +++++++++++++++++++++++-------
net/netlink/af_netlink.h | 9 +++++++++
2 files changed, 32 insertions(+), 7 deletions(-)
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -115,6 +115,24 @@ static inline struct hlist_head *nl_port
return &hash->table[jhash_1word(portid, hash->rnd) & hash->mask];
}
+static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
+ gfp_t gfp_mask)
+{
+ unsigned int len = skb_end_offset(skb);
+ struct sk_buff *new;
+
+ new = alloc_skb(len, gfp_mask);
+ if (new == NULL)
+ return NULL;
+
+ NETLINK_CB(new).portid = NETLINK_CB(skb).portid;
+ NETLINK_CB(new).dst_group = NETLINK_CB(skb).dst_group;
+ NETLINK_CB(new).creds = NETLINK_CB(skb).creds;
+
+ memcpy(skb_put(new, len), skb->data, len);
+ return new;
+}
+
int netlink_add_tap(struct netlink_tap *nt)
{
if (unlikely(nt->dev->type != ARPHRD_NETLINK))
@@ -199,7 +217,11 @@ static int __netlink_deliver_tap_skb(str
int ret = -ENOMEM;
dev_hold(dev);
- nskb = skb_clone(skb, GFP_ATOMIC);
+
+ if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head))
+ nskb = netlink_to_full_skb(skb, GFP_ATOMIC);
+ else
+ nskb = skb_clone(skb, GFP_ATOMIC);
if (nskb) {
nskb->dev = dev;
nskb->protocol = htons((u16) sk->sk_protocol);
@@ -271,11 +293,6 @@ static void netlink_rcv_wake(struct sock
}
#ifdef CONFIG_NETLINK_MMAP
-static bool netlink_skb_is_mmaped(const struct sk_buff *skb)
-{
- return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
-}
-
static bool netlink_rx_is_mmaped(struct sock *sk)
{
return nlk_sk(sk)->rx_ring.pg_vec != NULL;
@@ -827,7 +844,6 @@ static void netlink_ring_set_copied(stru
}
#else /* CONFIG_NETLINK_MMAP */
-#define netlink_skb_is_mmaped(skb) false
#define netlink_rx_is_mmaped(sk) false
#define netlink_tx_is_mmaped(sk) false
#define netlink_mmap sock_no_mmap
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -65,6 +65,15 @@ struct nl_portid_hash {
u32 rnd;
};
+static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NETLINK_MMAP
+ return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED;
+#else
+ return false;
+#endif /* CONFIG_NETLINK_MMAP */
+}
+
struct netlink_table {
struct nl_portid_hash hash;
struct hlist_head mc_list;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:20 +0200
[PATCH 3.14 01/84] blk-mq: fix buffer overflow when reading sysfs file of pending Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:20 +0200
[PATCH 3.14 07/84] arm64: compat: fix vfp save/restore across signal handlers in big-endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 08/84] arm64: head.S: initialise mdcr_el2 in el2_setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 81/84] x86/nmi/64: Reorder nested NMI checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 83/84] udf: Check length of extended attributes and allocation descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 72/84] rds: fix an integer overflow test in rds_info_getsockopt() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 63/84] ip6_gre: release cached dst on tunnel removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 60/84] inet: frags: fix defragmented packets IP header for af_packet Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 80/84] x86/nmi/64: Improve nested NMI comments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 75/84] net: gso: use feature flag argument in all protocol gso handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 03/84] rtlwifi: rtl8192cu: Add new device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 02/84] unshare: Unsharing a thread does not require unsharing a vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 52/84] net: Clone skb before setting peeked flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 69/84] openvswitch: Zero flows on allocation. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 82/84] x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 67/84] netlink, mmap: transform mmap skb into full skb on taps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 38/84] IB/mlx4: Forbid using sysfs to change RoCE pkeys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 70/84] fib_rules: fix fib rule dumps across multiple skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 79/84] x86/nmi/64: Switch stacks on userspace NMI entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
Re: [PATCH 3.14 79/84] x86/nmi/64: Switch stacks on userspace NMI entry Andy Lutomirski <luto@amacapital.net> - 2015-09-29 19:30 +0200
Re: [PATCH 3.14 79/84] x86/nmi/64: Switch stacks on userspace NMI entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 20:00 +0200
[PATCH 3.14 58/84] bonding: fix destruction of bond with devices different from arphrd_ether Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 47/84] net/tipc: initialize security state for new connection socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 55/84] bridge: mdb: fix double add notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 06/84] arm64: kconfig: Move LIST_POISON to a safe value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 78/84] x86/nmi/64: Remove asm code that saves CR2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 62/84] net/mlx4_core: Fix wrong index in propagating port change event to VFs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 14/84] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 84/84] NVMe: Initialize device reference count earlier Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 59/84] bonding: correct the MAC address for "follow" fail_over_mac policy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 12/84] ALSA: hda - Enable headphone jack detect on old Fujitsu laptops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 76/84] Revert "iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 29/84] vmscan: fix increasing nr_isolated incurred by putback unevictable pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 13/84] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 27/84] parisc: Use double word condition in 64bit CAS operation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 64/84] usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 35/84] IB/qib: Change lkey table allocation to support more MRs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 71/84] packet: missing dev_put() in packet_do_bind() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 61/84] netlink: dont hold mutex in rcu callback when releasing mmapd ring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 57/84] ipv6: lock socket in ip6_datagram_connect() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 37/84] IB/uverbs: Fix race between ib_uverbs_open and remove_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 65/84] ipv6: fix exthdrs offload registration in out_rt path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 53/84] net: Fix skb csum races when peeking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 48/84] bridge: mdb: zero out the local br_ip variable before use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 43/84] ipv6: Make MLD packets to only be processed locally Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:30 +0200
[PATCH 3.14 44/84] net: graceful exit from netif_alloc_netdev_queues() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 56/84] isdn/gigaset: reset tty->receive_room when attaching ser_gigaset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 49/84] net: pktgen: fix race between pktgen_thread_worker() and kthread_stop() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 33/84] xen/gntdev: convert priv->lock to a mutex Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 51/84] net: call rcu_read_lock early in process_backlog Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 36/84] IB/uverbs: reject invalid or unknown opcodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 32/84] md/raid10: always set reshape_safe when initializing reshape_position. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 34/84] hfs: fix B-tree corruption after insertion at position 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 50/84] net: do not process device backlog during unregistration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 54/84] net: Fix skb_set_peeked use-after-free bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 68/84] sctp: fix race on protocol/netns initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 45/84] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 30/84] fs: if a coredump already exists, unlink and recreate with O_EXCL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 77/84] x86/nmi: Enable nested do_nmi() handling for 64-bit kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 74/84] bna: fix interrupts storm caused by erroneous packets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 41/84] stmmac: troubleshoot unexpected bits in des0 & des1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 31/84] mmc: core: fix race condition in mmc_wait_data_done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 66/84] net/ipv6: Correct PIM6 mrt_lock handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 42/84] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:40 +0200
[PATCH 3.14 17/84] CIFS: fix type confusion in copy offload ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 20/84] x86/mm: Initialize pmd_idx in page_table_range_init_count() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 40/84] stmmac: fix check for phydev being open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
Re: [PATCH 3.14 40/84] stmmac: fix check for phydev being open Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> - 2015-09-30 13:30 +0200
Re: [PATCH 3.14 40/84] stmmac: fix check for phydev being open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-01 05:10 +0200
[PATCH 3.14 22/84] [media] v4l: omap3isp: Fix sub-device power management code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 11/84] Input: evdev - do not report errors form flush() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 16/84] powerpc/mm: Recompute hash value after a failed update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 24/84] NFSv4: dont set SETATTR for O_RDONLY|O_EXCL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 15/84] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 09/84] arm64: errata: add module build workaround for erratum #843419 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 10/84] arm64: KVM: Disable virtual timer even if the guest is not using it Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 23/84] Btrfs: check if previous transaction aborted to avoid fs corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 05/84] mac80211: enable assoc check for mesh interfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 28/84] parisc: Filter out spurious interrupts in PA-RISC irq handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 39/84] IB/mlx4: Use correct SL on AH query under RoCE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 19/84] mm: check if section present during memory block registering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 25/84] NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 04/84] tg3: Fix temperature reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 18/84] Add radeon suspend/resume quirk for HP Compaq dc5750. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
[PATCH 3.14 26/84] NFS: nfs_set_pgio_error sometimes misses errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 17:50 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-09-29 19:00 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 21:50 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-29 23:20 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-30 04:20 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-30 08:00 +0200
Re: [PATCH 3.14 00/84] 3.14.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-30 08:10 +0200
csiph-web