p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

netlink: fix netlink_ack() extack race 

It seems that it's possible to toggle NETLINK_F_EXT_ACK
through setsockopt() while another thread/CPU is building
a message inside netlink_ack(), which could then trigger
the WARN_ON()s I added since if it goes from being turned
off to being turned on between allocating and filling the
message, the skb could end up being too small.

Avoid this whole situation by storing the value of this
flag in a separate variable and using that throughout the
function instead.

Fixes: 2d4bc93368 ("netlink: extended ACK reporting")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Johannes Berg 2017-10-16 17:09:53 +02:00 committed by David S. Miller
parent 2de09681e4
commit 48044eb490
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
net/netlink/af_netlink.c
View File

@ -2307,6 +2307,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
size_t tlvlen = 0; size_t tlvlen = 0;
struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk); struct netlink_sock *nlk = nlk_sk(NETLINK_CB(in_skb).sk);
unsigned int flags = 0; unsigned int flags = 0;
bool nlk_has_extack = nlk->flags & NETLINK_F_EXT_ACK;
/* Error messages get the original request appened, unless the user /* Error messages get the original request appened, unless the user
* requests to cap the error message, and get extra error data if * requests to cap the error message, and get extra error data if
@ -2317,7 +2318,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
payload += nlmsg_len(nlh); payload += nlmsg_len(nlh);
else else
flags |= NLM_F_CAPPED; flags |= NLM_F_CAPPED;
if (nlk->flags & NETLINK_F_EXT_ACK && extack) { if (nlk_has_extack && extack) {
if (extack->_msg) if (extack->_msg)
tlvlen += nla_total_size(strlen(extack->_msg) + 1); tlvlen += nla_total_size(strlen(extack->_msg) + 1);
if (extack->bad_attr) if (extack->bad_attr)
@ -2326,8 +2327,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
} else { } else {
flags |= NLM_F_CAPPED; flags |= NLM_F_CAPPED;
if (nlk->flags & NETLINK_F_EXT_ACK && if (nlk_has_extack && extack && extack->cookie_len)
extack && extack->cookie_len)
tlvlen += nla_total_size(extack->cookie_len); tlvlen += nla_total_size(extack->cookie_len);
} }
@ -2355,7 +2355,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
errmsg->error = err; errmsg->error = err;
memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh)); memcpy(&errmsg->msg, nlh, payload > sizeof(*errmsg) ? nlh->nlmsg_len : sizeof(*nlh));
if (nlk->flags & NETLINK_F_EXT_ACK && extack) { if (nlk_has_extack && extack) {
if (err) { if (err) {
if (extack->_msg) if (extack->_msg)
WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG, WARN_ON(nla_put_string(skb, NLMSGERR_ATTR_MSG,