Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1740685 > unrolled thread

[PATCH] netlink: do not proceed if dump's start() errs

Back to article view | Back to linux.kernel

Contents

  [PATCH] netlink: do not proceed if dump's start() errs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-09-27 14:50 +0200
    Re: [PATCH] netlink: do not proceed if dump's start() errs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-09-27 15:00 +0200
      Re: [PATCH] netlink: do not proceed if dump's start() errs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-09-27 15:10 +0200
        [PATCH v2] netlink: do not proceed if dump's start() errs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-09-28 00:50 +0200
          Re: [PATCH v2] netlink: do not proceed if dump's start() errs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-09-28 12:50 +0200
          Re: [PATCH v2] netlink: do not proceed if dump's start() errs David Miller <davem@davemloft.net> - 2017-09-30 08:30 +0200
          Re: [PATCH v2] netlink: do not proceed if dump's start() errs Johannes Berg <johannes@sipsolutions.net> - 2017-09-30 09:40 +0200
            Re: [PATCH v2] netlink: do not proceed if dump's start() errs David Miller <davem@davemloft.net> - 2017-09-30 17:20 +0200
      Re: [PATCH] netlink: do not proceed if dump's start() errs Johannes Berg <johannes@sipsolutions.net> - 2017-09-27 15:10 +0200

#1740685 — [PATCH] netlink: do not proceed if dump's start() errs

Drivers that use the start method for netlink dumping rely on dumpit not
being called if start fails. For example, ila_xlat.c allocates memory
and assigns it to cb->args[0] in its start() function. It might fail to
do that and return -ENOMEM instead. However, even when returning an
error, dumpit will be called, which, in the example above, quickly
dereferences the memory in cb->args[0], which will OOPS the kernel. This
is but one example of how this goes wrong.

Since start() has always been a function with an int return type, it
therefore makes sense to use it properly, rather than ignoring it. This
patch thus returns early and does not call dumpit() when start() fails.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: stable@vger.kernel.org
---
 net/netlink/af_netlink.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 327807731b44..be179876227d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2270,8 +2270,11 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
 	mutex_unlock(nlk->cb_mutex);
 
-	if (cb->start)
-		cb->start(cb);
+	if (cb->start) {
+		ret = cb->start(cb);
+		if (ret)
+			return ret;
+	}
 
 	ret = netlink_dump(sk);
 	sock_put(sk);
-- 
2.14.1

[toc] | [next] | [standalone]

#1740697

On Wed, Sep 27, 2017 at 2:39 PM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> -       if (cb->start)
> -               cb->start(cb);
> +       if (cb->start) {
> +               ret = cb->start(cb);
> +               if (ret)

I need to sock_put(sk); before returning. I'll fix this for v2, but
will for additional comments in case anybody has some.

> +                       return ret;
> +       }
>
>         ret = netlink_dump(sk);
>         sock_put(sk);

[toc] | [prev] | [next] | [standalone]

#1740699

On Wed, Sep 27, 2017 at 3:05 PM, Johannes Berg
<johannes@sipsolutions.net> wrote:
> I guess you could change it to
>
> if (cb->start)
>         ret = cb->start(cb);
> if (!ret)
>         ret = netlink_dump(sk);

Very clean. I'll do it like that. I'll wait a bit longer before
submitting v2, but beyond that, seems sane to you?

Jason

[toc] | [prev] | [next] | [standalone]

#1741081 — [PATCH v2] netlink: do not proceed if dump's start() errs

Drivers that use the start method for netlink dumping rely on dumpit not
being called if start fails. For example, ila_xlat.c allocates memory
and assigns it to cb->args[0] in its start() function. It might fail to
do that and return -ENOMEM instead. However, even when returning an
error, dumpit will be called, which, in the example above, quickly
dereferences the memory in cb->args[0], which will OOPS the kernel. This
is but one example of how this goes wrong.

Since start() has always been a function with an int return type, it
therefore makes sense to use it properly, rather than ignoring it. This
patch thus returns early and does not call dumpit() when start() fails.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
---
 net/netlink/af_netlink.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 327807731b44..94c11cf0459d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2270,10 +2270,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
 	mutex_unlock(nlk->cb_mutex);
 
+	ret = 0;
 	if (cb->start)
-		cb->start(cb);
+		ret = cb->start(cb);
+
+	if (!ret)
+		ret = netlink_dump(sk);
 
-	ret = netlink_dump(sk);
 	sock_put(sk);
 
 	if (ret)
-- 
2.14.1

[toc] | [prev] | [next] | [standalone]

#1741416 — Re: [PATCH v2] netlink: do not proceed if dump's start() errs

On Thu, Sep 28, 2017 at 12:41:44AM +0200, Jason A. Donenfeld wrote:
> diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
> index 327807731b44..94c11cf0459d 100644
> --- a/net/netlink/af_netlink.c
> +++ b/net/netlink/af_netlink.c
> @@ -2270,10 +2270,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
>  
>  	mutex_unlock(nlk->cb_mutex);
>  
> +	ret = 0;
>  	if (cb->start)
> -		cb->start(cb);
> +		ret = cb->start(cb);
> +
> +	if (!ret)
> +		ret = netlink_dump(sk);
>  
> -	ret = netlink_dump(sk);
>  	sock_put(sk);
>  
>  	if (ret)


FYI, using this horrific hack to currently work around bug:

    #define KERNEL_VERSION_THAT_HAS_NETLINK_START_FIX KERNEL_VERSION(4, 14, 0) /* Hopefully! */

    static int get(struct sk_buff *skb, struct netlink_callback *cb)
    {
    #if LINUX_VERSION_CODE < KERNEL_VERSION_THAT_HAS_NETLINK_START_FIX
        /* https://marc.info/?l=linux-netdev&m=150655213004221&w=2 */
        if (!cb->args[0]) {
            ret = get_start(cb);
            if (ret)
                return ret;
        }
    #endif
        ...
    }

    static const struct genl_ops genl_ops[] = {
        {
            .cmd = CMD_GET,
    #if LINUX_VERSION_CODE >= KERNEL_VERSION_THAT_HAS_NETLINK_START_FIX
            /* https://marc.info/?l=linux-netdev&m=150655213004221&w=2 */
            .start = get_start,
    #endif
            .dumpit = get,
            ...
        }
    }

Gross.

[toc] | [prev] | [next] | [standalone]

#1742528 — Re: [PATCH v2] netlink: do not proceed if dump's start() errs

From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Date: Thu, 28 Sep 2017 00:41:44 +0200

> Drivers that use the start method for netlink dumping rely on dumpit not
> being called if start fails. For example, ila_xlat.c allocates memory
> and assigns it to cb->args[0] in its start() function. It might fail to
> do that and return -ENOMEM instead. However, even when returning an
> error, dumpit will be called, which, in the example above, quickly
> dereferences the memory in cb->args[0], which will OOPS the kernel. This
> is but one example of how this goes wrong.
> 
> Since start() has always been a function with an int return type, it
> therefore makes sense to use it properly, rather than ignoring it. This
> patch thus returns early and does not call dumpit() when start() fails.
> 
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> Cc: Johannes Berg <johannes@sipsolutions.net>

Johannes, this looks straightforward to me, but please would you give
it a quick review?

Thank you.

[toc] | [prev] | [next] | [standalone]

#1742556 — Re: [PATCH v2] netlink: do not proceed if dump's start() errs

On Thu, 2017-09-28 at 00:41 +0200, Jason A. Donenfeld wrote:
> Drivers that use the start method for netlink dumping rely on dumpit
> not
> being called if start fails. For example, ila_xlat.c allocates memory
> and assigns it to cb->args[0] in its start() function. It might fail
> to
> do that and return -ENOMEM instead. However, even when returning an
> error, dumpit will be called, which, in the example above, quickly
> dereferences the memory in cb->args[0], which will OOPS the kernel.
> This
> is but one example of how this goes wrong.
> 
> Since start() has always been a function with an int return type, it
> therefore makes sense to use it properly, rather than ignoring it.
> This
> patch thus returns early and does not call dumpit() when start()
> fails.
> 
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

Reviewed-by: Johannes Berg <johannes@sipsolutions.net>


FWIW, I found another (indirect, via genetlink, like ila_xlat.c) in-
tree user that cares and expects the correct failure behaviour:

net/ipv6/seg6.c
	.start  = seg6_genl_dumphmac_start,

which can also have memory allocation failures. No others appear to
exist, afaict.

Either way, perhaps it's worth sending this to stable for that reason.

johannes

[toc] | [prev] | [next] | [standalone]

#1742639 — Re: [PATCH v2] netlink: do not proceed if dump's start() errs

From: Johannes Berg <johannes@sipsolutions.net>
Date: Sat, 30 Sep 2017 08:56:10 +0200

> On Thu, 2017-09-28 at 00:41 +0200, Jason A. Donenfeld wrote:
>> Drivers that use the start method for netlink dumping rely on dumpit
>> not
>> being called if start fails. For example, ila_xlat.c allocates memory
>> and assigns it to cb->args[0] in its start() function. It might fail
>> to
>> do that and return -ENOMEM instead. However, even when returning an
>> error, dumpit will be called, which, in the example above, quickly
>> dereferences the memory in cb->args[0], which will OOPS the kernel.
>> This
>> is but one example of how this goes wrong.
>> 
>> Since start() has always been a function with an int return type, it
>> therefore makes sense to use it properly, rather than ignoring it.
>> This
>> patch thus returns early and does not call dumpit() when start()
>> fails.
>> 
>> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> 
> Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
 ...
> Either way, perhaps it's worth sending this to stable for that reason.

Agreed, applied and queued up for -stable, thanks.

[toc] | [prev] | [next] | [standalone]

#1740702

On Wed, 2017-09-27 at 14:50 +0200, Jason A. Donenfeld wrote:
> On Wed, Sep 27, 2017 at 2:39 PM, Jason A. Donenfeld <Jason@zx2c4.com>
> wrote:
> > -       if (cb->start)
> > -               cb->start(cb);
> > +       if (cb->start) {
> > +               ret = cb->start(cb);
> > +               if (ret)
> 
> I need to sock_put(sk); before returning. I'll fix this for v2, but
> will for additional comments in case anybody has some.

I guess you could change it to

if (cb->start)
	ret = cb->start(cb);
if (!ret)
	ret = netlink_dump(sk);

johannes

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web