netdev - Re: [PATCH] netlink: fixup regression in RTM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 30 Dec 2018 18:48:38 -0700
From:   David Ahern <dsahern@...il.com>
To:     baloo@...di.net, netdev@...r.kernel.org
Cc:     "David S . Miller" <davem@...emloft.net>
Subject: Re: [PATCH] netlink: fixup regression in RTM_GETADDR

On 12/30/18 11:15 AM, baloo@...di.net wrote:
> From: Arthur Gautier <baloo@...di.net>
> 
> This commit fixes a regression in AF_INET/RTM_GETADDR and
> AF_INET6/RTM_GETADDR. The AF_UNSPEC/RTM_GETADDR was not affected by this as
> rtnl_dump_all would just hide the errno.
> 
> Before this commit, the kernel would stop dumping addresses once the first
> skb was full and end the stream with NLMSG_DONE(-EMSGSIZE). The callback
> should be kept alive as the userspace is expected to call back with a new
> empty skb.
> 
> Fixes: d7e38611b81e ("net/ipv4: Put target net when address dump fails due to bad attributes")
> Fixes: 242afaa6968c ("net/ipv6: Put target net when address dump fails due to bad attributes")
> 
> Cc: David Ahern <dsahern@...il.com>
> Cc: "David S . Miller" <davem@...emloft.net>
> Cc: netdev@...r.kernel.org
> Signed-off-by: Arthur Gautier <baloo@...di.net>
> ---
>  net/netlink/af_netlink.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
> index 3c023d6120f65..0a48bca246bc4 100644
> --- a/net/netlink/af_netlink.c
> +++ b/net/netlink/af_netlink.c
> @@ -2245,6 +2245,15 @@ static int netlink_dump(struct sock *sk)
>  		cb->extack = NULL;
>  	}
>  
> +	/* Should the dump method run out of space, we have to
> +	 * keep the dumper running until completion.
> +	 * Just ignore the error, userspace should call back with a
> +	 * new skb until dump is complete
> +	 */
> +	if (nlk->dump_done_errno == -EMSGSIZE) {
> +		nlk->dump_done_errno = skb->len;
> +	}
> +
>  	if (nlk->dump_done_errno > 0 ||
>  	    skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
>  		mutex_unlock(nlk->cb_mutex);
> 

This should be in inet_dump_ifaddr and inet6_dump_addr. Instead of:
	return err < 0 ? err : skb->len;

it should be
	return skb->len ? : err;