Skip to contentSkip to conversation

fix zombie netlink socket in user space

PATCH In review Pablo Neira 3 participants 4 messages Sep 19, 2004

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 fix zombie netlink socket in user space

Hi Davem,

If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list. The problem is that the head can't be delete, so that socket stays in the list forever (see sk_del_node_init).

If I'm missing something, please let me know. I'll submit a 2.4 version

regards,
Pablo

net/netlink/af_netlink.c +19 -0
diff -u -r1.2 af_netlink.c
@@ -306,6 +306,19 @@
 	return 0;
 }
 
+static inline int netlink_socket_exist(int protocol)
+{
+	/* Wanna bind to an non-existant netlink socket? */
+	netlink_table_grab();
+	if (!sk_head(&nl_table[protocol])) {
+		netlink_table_ungrab();
+		return 0;
+	}
+	netlink_table_ungrab();
+
+	return 1;
+}
+
 static int netlink_autobind(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
@@ -351,6 +364,9 @@
 	if (nladdr->nl_family != AF_NETLINK)
 		return -EINVAL;
 
+        if (!netlink_socket_exist(sk->sk_protocol))
+		return -ENOENT;
+
 	/* Only superuser is allowed to listen multicasts */
 	if (nladdr->nl_groups && !netlink_capable(sock, NL_NONROOT_RECV))
 		return -EPERM;
@@ -392,6 +408,9 @@
 	if (addr->sa_family != AF_NETLINK)
 		return -EINVAL;
 
+        if (!netlink_socket_exist(sk->sk_protocol))
+		return -ENOENT;
+
 	/* Only superuser is allowed to send multicasts */
 	if (nladdr->nl_groups && !netlink_capable(sock, NL_NONROOT_SEND))
 		return -EPERM;
#1 lore raw
Quoted 5 lines · Pablo Neira

If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list. The problem is that the head can't be delete, so that socket stays in the list forever (see sk_del_node_init).

Huh? Where does it say that the head can't be deleted?

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
#2 lore raw

Theres also a fundamental issue in trying to control bind/connect behavior with the way this patch tries to "fix" things. Theres at least one app i know of which depends on this.
Dave, whats acceptable? My thinking is this should probably be controlled by something like the SE linux path?

cheers,
jamal

Quoted 8 lines · Herbert Xu
Quoted 5 lines · Pablo Neira

If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list. The problem is that the head can't be delete, so that socket stays in the list forever (see sk_del_node_init).

Huh? Where does it say that the head can't be deleted?

#3 lore raw
In reply to Pablo Neira
Quoted 1 line · Pablo Neira

If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list.

BTW oh please, forget this patch...

regards,
Pablo