netdev - [PATCH] netlink: fixup regression in RTM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181230181549.25733-1-baloo@gandi.net>
Date:   Sun, 30 Dec 2018 18:15:49 +0000
From:   baloo@...di.net
To:     netdev@...r.kernel.org
Cc:     Arthur Gautier <baloo@...di.net>, David Ahern <dsahern@...il.com>,
        "David S . Miller" <davem@...emloft.net>
Subject: [PATCH] netlink: fixup regression in RTM_GETADDR

From: Arthur Gautier <baloo@...di.net>

This commit fixes a regression in AF_INET/RTM_GETADDR and
AF_INET6/RTM_GETADDR. The AF_UNSPEC/RTM_GETADDR was not affected by this as
rtnl_dump_all would just hide the errno.

Before this commit, the kernel would stop dumping addresses once the first
skb was full and end the stream with NLMSG_DONE(-EMSGSIZE). The callback
should be kept alive as the userspace is expected to call back with a new
empty skb.

Fixes: d7e38611b81e ("net/ipv4: Put target net when address dump fails due to bad attributes")
Fixes: 242afaa6968c ("net/ipv6: Put target net when address dump fails due to bad attributes")

Cc: David Ahern <dsahern@...il.com>
Cc: "David S . Miller" <davem@...emloft.net>
Cc: netdev@...r.kernel.org
Signed-off-by: Arthur Gautier <baloo@...di.net>
---
 net/netlink/af_netlink.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 3c023d6120f65..0a48bca246bc4 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2245,6 +2245,15 @@ static int netlink_dump(struct sock *sk)
 		cb->extack = NULL;
 	}
 
+	/* Should the dump method run out of space, we have to
+	 * keep the dumper running until completion.
+	 * Just ignore the error, userspace should call back with a
+	 * new skb until dump is complete
+	 */
+	if (nlk->dump_done_errno == -EMSGSIZE) {
+		nlk->dump_done_errno = skb->len;
+	}
+
 	if (nlk->dump_done_errno > 0 ||
 	    skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
 		mutex_unlock(nlk->cb_mutex);
-- 
2.20.1