fix zombie netlink socket in user space
Subsystems (2)
PATCH 1/1 fix zombie netlink socket in user space
Hi Davem,
If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list. The problem is that the head can't be delete, so that socket stays in the list forever (see sk_del_node_init).
If I'm missing something, please let me know. I'll submit a 2.4 version
regards,
Pablo
net/netlink/af_netlink.c +19 -0
@@ -306,6 +306,19 @@return 0 ; } +static inline int netlink_socket_exist (int protocol) +{ +/* Wanna bind to an non-existant netlink socket? */ +netlink_table_grab (); +if (!sk_head (&nl_table[protocol])) { +netlink_table_ungrab (); +return 0 ; + } +netlink_table_ungrab (); + +return 1 ; +} +static int netlink_autobind (struct socket *sock) {struct sock *sk = sock->sk;
@@ -351,6 +364,9 @@if (nladdr->nl_family !=AF_NETLINK )return -EINVAL ; +if (!netlink_socket_exist (sk->sk_protocol)) +return -ENOENT ; +/* Only superuser is allowed to listen multicasts */ if (nladdr->nl_groups && !netlink_capable (sock,NL_NONROOT_RECV ))return -EPERM ;
@@ -392,6 +408,9 @@if (addr->sa_family !=AF_NETLINK )return -EINVAL ; +if (!netlink_socket_exist (sk->sk_protocol)) +return -ENOENT ; +/* Only superuser is allowed to send multicasts */ if (nladdr->nl_groups && !netlink_capable (sock,NL_NONROOT_SEND ))return -EPERM ;
Quoted 5 lines · Pablo Neira
If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list. The problem is that the head can't be delete, so that socket stays in the list forever (see
sk_del_node_init).
Huh? Where does it say that the head can't be deleted?
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txtTheres also a fundamental issue in trying to control bind/connect behavior with the way this patch tries to "fix" things. Theres at least one app i know of which depends on this.
Dave, whats acceptable? My thinking is this should probably be controlled by something like the SE linux path?
cheers,
jamal
Quoted 8 lines · Herbert Xu
Quoted 5 lines · Pablo Neira
If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list. The problem is that the head can't be delete, so that socket stays in the list forever (see
sk_del_node_init).Huh? Where does it say that the head can't be deleted?
Quoted 1 line · Pablo Neira
If you try to bind/connect to a non existant netlink socket, client socket gets succesfully inserted as head in the socket list.
BTW oh please, forget this patch...
regards,
Pablo