netlink: do not proceed if dump's start() errs

PATCH Superseded Jason A. Donenfeld 3 participants 9 messages Sep 27, 2017 – Sep 30, 2017

Subsystems (3)

Networking Network drivers Stable branch

lore

Share & tools

lore

Jason A. Donenfeld

author

2017-09-27 12:39 UTC #0 lore raw

PATCH 1/1 netlink: do not proceed if dump's start() errs

Drivers that use the start method for netlink dumping rely on dumpit not being called if start fails. For example, ila_xlat.c allocates memory and assigns it to cb->args[0] in its start() function. It might fail to do that and return -ENOMEM instead. However, even when returning an error, dumpit will be called, which, in the example above, quickly dereferences the memory in cb->args[0], which will OOPS the kernel. This is but one example of how this goes wrong.

Since start() has always been a function with an int return type, it therefore makes sense to use it properly, rather than ignoring it. This patch thus returns early and does not call dumpit() when start() fails.

Signed-off-by Jason A. Donenfeld <[email protected]>

Cc [email protected]

---
 net/netlink/af_netlink.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

net/netlink/af_netlink.c +5 -2

index 327807731b44..be179876227d 100644
@@ -2270,8 +2270,11 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
 	mutex_unlock(nlk->cb_mutex);
 
-	if (cb->start)
-		cb->start(cb);
+	if (cb->start) {
+		ret = cb->start(cb);
+		if (ret)
+			return ret;
+	}
 
 	ret = netlink_dump(sk);
 	sock_put(sk);

Signature · 1 line

2.14.1

Jason A. Donenfeld

author

2017-09-27 12:50 UTC #1 lore raw

net/netlink/af_netlink.c int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, · line 2275

Quoted 5 lines · Jason A. Donenfeld

net/netlink/af_netlink.c +3 -2

-       if (cb->start)
-               cb->start(cb);
+       if (cb->start) {
+               ret = cb->start(cb);
+               if (ret)

I need to sock_put(sk); before returning. I'll fix this for v2, but will for additional comments in case anybody has some.

Quoted 5 lines

net/netlink/af_netlink.c +2 -0

+                       return ret;
+       }
 
        ret = netlink_dump(sk);
        sock_put(sk);

Johannes Berg

2017-09-27 13:05 UTC #2 lore raw

Quoted 10 lines · Jason A. Donenfeld

Quoted 5 lines · Jason A. Donenfeld
-       if (cb->start)
-               cb->start(cb);
+       if (cb->start) {
+               ret = cb->start(cb);
+               if (ret)
I need to sock_put(sk); before returning. I'll fix this for v2, but will for additional comments in case anybody has some.

I guess you could change it to

if (cb->start)

	ret = cb->start(cb);
if (!ret)
	ret = netlink_dump(sk);

johannes

Jason A. Donenfeld

author

2017-09-27 13:06 UTC #3 lore raw

Quoted 6 lines · Johannes Berg

I guess you could change it to
if (cb->start)
        ret = cb->start(cb);
if (!ret)
        ret = netlink_dump(sk);

Very clean. I'll do it like that. I'll wait a bit longer before submitting v2, but beyond that, seems sane to you?

Jason

Jason A. Donenfeld

author

2017-09-27 22:41 UTC #4 lore raw

PATCH v2 1/1 netlink: do not proceed if dump's start() errs

Signed-off-by Jason A. Donenfeld <[email protected]>

Cc Johannes Berg <[email protected]>

---
 net/netlink/af_netlink.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

net/netlink/af_netlink.c +5 -2

index 327807731b44..94c11cf0459d 100644
@@ -2270,10 +2270,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
 	mutex_unlock(nlk->cb_mutex);
 
+	ret = 0;
 	if (cb->start)
-		cb->start(cb);
+		ret = cb->start(cb);
+
+	if (!ret)
+		ret = netlink_dump(sk);
 
-	ret = netlink_dump(sk);
 	sock_put(sk);
 
 	if (ret)

Signature · 1 line

2.14.1

Jason A. Donenfeld

author

2017-09-28 10:40 UTC #5 lore raw

Quoted 10 lines · Jason A. Donenfeld

net/netlink/af_netlink.c +1 -0

index 327807731b44..94c11cf0459d 100644
@@ -2270,10 +2270,13 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
 	mutex_unlock(nlk->cb_mutex);
 
+	ret = 0;
 	if (cb->start)

net/netlink/af_netlink.c int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, · line 2282

Quoted 10 lines

net/netlink/af_netlink.c +4 -2

-		cb->start(cb);
+		ret = cb->start(cb);
+
+	if (!ret)
+		ret = netlink_dump(sk);
 
-	ret = netlink_dump(sk);
 	sock_put(sk);
 
 	if (ret)

FYI, using this horrific hack to currently work around bug:

    #define KERNEL_VERSION_THAT_HAS_NETLINK_START_FIX KERNEL_VERSION(4, 14, 0) /* Hopefully! */

    static int get(struct sk_buff *skb, struct netlink_callback *cb)
    {
    #if LINUX_VERSION_CODE < KERNEL_VERSION_THAT_HAS_NETLINK_START_FIX
        /* https://marc.info/?l=linux-netdev&m=150655213004221&w=2 */
        if (!cb->args[0]) {
            ret = get_start(cb);
            if (ret)
                return ret;
        }
    #endif
        ...
    }

    static const struct genl_ops genl_ops[] = {
        {
            .cmd = CMD_GET,
    #if LINUX_VERSION_CODE >= KERNEL_VERSION_THAT_HAS_NETLINK_START_FIX
            /* https://marc.info/?l=linux-netdev&m=150655213004221&w=2 */
            .start = get_start,
    #endif
            .dumpit = get,
            ...
        }
    }

Gross.

David Miller

maintainer

2017-09-30 06:27 UTC #6 lore raw

In reply to Jason A. Donenfeld

From: "Jason A. Donenfeld" <[email protected]>
Date: Thu, 28 Sep 2017 00:41:44 +0200

Quoted 8 lines

Drivers that use the start method for netlink dumping rely on dumpit not being called if start fails. For example, ila_xlat.c allocates memory and assigns it to cb->args[0] in its start() function. It might fail to do that and return -ENOMEM instead. However, even when returning an error, dumpit will be called, which, in the example above, quickly dereferences the memory in cb->args[0], which will OOPS the kernel. This is but one example of how this goes wrong.

Quoted 6 lines

Since start() has always been a function with an int return type, it therefore makes sense to use it properly, rather than ignoring it. This patch thus returns early and does not call dumpit() when start() fails.
Signed-off-by Jason A. Donenfeld <[email protected]>
Cc Johannes Berg <[email protected]>

Johannes, this looks straightforward to me, but please would you give it a quick review?

Thank you.

Johannes Berg

Reviewed-by on v2 1/1

2017-09-30 06:56 UTC #7 lore raw

In reply to Jason A. Donenfeld

Quoted 11 lines · Jason A. Donenfeld

Drivers that use the start method for netlink dumping rely on dumpit not
being called if start fails. For example, ila_xlat.c allocates memory and assigns it to cb->args[0] in its start() function. It might fail to
do that and return -ENOMEM instead. However, even when returning an error, dumpit will be called, which, in the example above, quickly dereferences the memory in cb->args[0], which will OOPS the kernel. This
is but one example of how this goes wrong.

Quoted 7 lines

Since start() has always been a function with an int return type, it therefore makes sense to use it properly, rather than ignoring it. This
patch thus returns early and does not call dumpit() when start() fails.
Signed-off-by Jason A. Donenfeld <[email protected]>

Reviewed-by Johannes Berg <[email protected]>

FWIW, I found another (indirect, via genetlink, like ila_xlat.c) in- tree user that cares and expects the correct failure behaviour:

net/ipv6/seg6.c
.start = seg6_genl_dumphmac_start,

which can also have memory allocation failures. No others appear to exist, afaict.

Either way, perhaps it's worth sending this to stable for that reason.

johannes

David Miller

maintainer

2017-09-30 15:14 UTC #8 lore raw

From: Johannes Berg <[email protected]>
Date: Sat, 30 Sep 2017 08:56:10 +0200

Quoted 21 lines · Jason A. Donenfeld

Quoted 11 lines
Drivers that use the start method for netlink dumping rely on dumpit not
being called if start fails. For example, ila_xlat.c allocates memory and assigns it to cb->args[0] in its start() function. It might fail to
do that and return -ENOMEM instead. However, even when returning an error, dumpit will be called, which, in the example above, quickly dereferences the memory in cb->args[0], which will OOPS the kernel. This
is but one example of how this goes wrong.
Quoted 7 lines
Since start() has always been a function with an int return type, it therefore makes sense to use it properly, rather than ignoring it. This
patch thus returns early and does not call dumpit() when start() fails.
Signed-off-by Jason A. Donenfeld <[email protected]>
Reviewed-by Johannes Berg <[email protected]>

...

Quoted 1 line

Either way, perhaps it's worth sending this to stable for that reason.

Agreed, applied and queued up for -stable, thanks.