lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 27 Mar 2020 08:39:23 +0800 From: Yafang Shao <laoar.shao@...il.com> To: David Ahern <dsahern@...il.com> Cc: Johannes Berg <johannes@...solutions.net>, Andrew Morton <akpm@...ux-foundation.org>, bsingharora@...il.com, LKML <linux-kernel@...r.kernel.org>, stable@...r.kernel.org, "David S.Miller" <davem@...emloft.net> Subject: Re: [PATCH] kernel/taskstats: fix wrong nla type for {cgroup,task}stats policy On Fri, Mar 27, 2020 at 5:11 AM David Ahern <dsahern@...il.com> wrote: > > On 3/26/20 2:28 PM, Johannes Berg wrote: > > > > And looking at this ... well, that code is completely wrong? > > > > E.g. > > > > rc = send_cmd(nl_sd, id, mypid, TASKSTATS_CMD_GET, > > cmd_type, &tid, sizeof(__u32)); > > > > (cmd_type is one of TASKSTATS_CMD_ATTR_TGID, TASKSTATS_CMD_ATTR_PID) > > > > or it might do > > > > rc = send_cmd(nl_sd, id, mypid, CGROUPSTATS_CMD_GET, > > CGROUPSTATS_CMD_ATTR_FD, &cfd, sizeof(__u32)); > > > > so clearly it wants to produce a u32 attribute. > > > > But then > > > > static int send_cmd(int sd, __u16 nlmsg_type, __u32 nlmsg_pid, > > __u8 genl_cmd, __u16 nla_type, > > void *nla_data, int nla_len) > > { > > ... > > > > na = (struct nlattr *) GENLMSG_DATA(&msg); > > > > // this is still fine > > > > na->nla_type = nla_type; > > > > // this is also fine > > > > na->nla_len = nla_len + 1 + NLA_HDRLEN; > > > > // but this??? the nla_len of a netlink attribute should just be > > // the len ... what's NLA_HDRLEN doing here? this isn't nested > > // here we end up just reserving 1+NLA_HDRLEN too much space > > > > memcpy(NLA_DATA(na), nla_data, nla_len); > > > > // but then it anyway only fills the first nla_len bytes, which > > // is just like a regular attribute. > > > > msg.n.nlmsg_len += NLMSG_ALIGN(na->nla_len); > > // note that this is also wrong - it should be > > // += NLA_ALIGN(NLA_HDRLEN + nla_len) > > > > > > > > So really I think what happened here is precisely what we wanted - > > David's kernel patch caught the broken userspace tool. > > agreed. The tool needs to be fixed, not the kernel policy. > > I do not get the error message with this change as Johannes points out > above: > > diff --git a/tools/accounting/getdelays.c b/tools/accounting/getdelays.c > index 8cb504d30384..e90fd133df0e 100644 > --- a/tools/accounting/getdelays.c > +++ b/tools/accounting/getdelays.c > @@ -136,7 +136,7 @@ static int send_cmd(int sd, __u16 nlmsg_type, __u32 > nlmsg_pid, > msg.g.version = 0x1; > na = (struct nlattr *) GENLMSG_DATA(&msg); > na->nla_type = nla_type; > - na->nla_len = nla_len + 1 + NLA_HDRLEN; > + na->nla_len = nla_len + NLA_HDRLEN; > memcpy(NLA_DATA(na), nla_data, nla_len); > msg.n.nlmsg_len += NLMSG_ALIGN(na->nla_len); > Right. This is the right thing to do. I missed that the nla_len() will minus the NLA_HDRLEN. Would you pls. submit a patch ? Feel free to add: Tested-by: Yafang Shao <laoar.shao@...il.com> Thanks Yafang
Powered by blists - more mailing lists