netdev - [patch net-next] net: genetlink: always allocate separate attrs for dumpit ops,

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191008103143.29200-1-jiri@resnulli.us>
Date:   Tue,  8 Oct 2019 12:31:43 +0200
From:   Jiri Pirko <jiri@...nulli.us>
To:     netdev@...r.kernel.org
Cc:     davem@...emloft.net, jakub.kicinski@...ronome.com,
        alex.aring@...il.com, stefan@...enfreihafen.org,
        jon.maloy@...csson.com, ying.xue@...driver.com,
        johannes.berg@...el.com, mkubecek@...e.cz, yuehaibing@...wei.com,
        mlxsw@...lanox.com
Subject: [patch net-next] net: genetlink: always allocate separate attrs for dumpit ops,

From: Jiri Pirko <jiri@...lanox.com>

Individual dumpit ops (start, dumpit, done) are locked by genl_lock
for if !family->parallel_ops. However, multiple
genl_family_rcv_msg_dumpit() calls may in in flight in parallel.
Each has a separate struct genl_dumpit_info allocated
but they share the same family->attrbuf. Fix this by allocating separate
memory for attrs for dumpit ops, for non-parallel_ops (for parallel_ops
it is done already).

Reported-by: syzbot+495688b736534bb6c6ad@...kaller.appspotmail.com
Reported-by: syzbot+ff59dc711f2cff879a05@...kaller.appspotmail.com
Reported-by: syzbot+dbe02e13bcce52bcf182@...kaller.appspotmail.com
Reported-by: syzbot+9cb7edb2906ea1e83006@...kaller.appspotmail.com
Fixes: bf813b0afeae ("net: genetlink: parse attrs and store in contect info struct during dumpit")
Signed-off-by: Jiri Pirko <jiri@...lanox.com>
---
 net/netlink/genetlink.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 1b5046436765..ecc2bd3e73e4 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -474,7 +474,8 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
 				struct netlink_ext_ack *extack,
 				const struct genl_ops *ops,
 				int hdrlen,
-				enum genl_validate_flags no_strict_flag)
+				enum genl_validate_flags no_strict_flag,
+				bool parallel)
 {
 	enum netlink_validation validate = ops->validate & no_strict_flag ?
 					   NL_VALIDATE_LIBERAL :
@@ -482,7 +483,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
 	struct nlattr **attrbuf;
 	int err;
 
-	if (family->maxattr && family->parallel_ops) {
+	if (parallel) {
 		attrbuf = kmalloc_array(family->maxattr + 1,
 					sizeof(struct nlattr *), GFP_KERNEL);
 		if (!attrbuf)
@@ -493,7 +494,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
 
 	err = __nlmsg_parse(nlh, hdrlen, attrbuf, family->maxattr,
 			    family->policy, validate, extack);
-	if (err && family->maxattr && family->parallel_ops) {
+	if (err && parallel) {
 		kfree(attrbuf);
 		return ERR_PTR(err);
 	}
@@ -501,9 +502,10 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
 }
 
 static void genl_family_rcv_msg_attrs_free(const struct genl_family *family,
-					   struct nlattr **attrbuf)
+					   struct nlattr **attrbuf,
+					   bool parallel)
 {
-	if (family->maxattr && family->parallel_ops)
+	if (parallel)
 		kfree(attrbuf);
 }
 
@@ -542,7 +544,7 @@ static int genl_lock_done(struct netlink_callback *cb)
 		rc = ops->done(cb);
 		genl_unlock();
 	}
-	genl_family_rcv_msg_attrs_free(info->family, info->attrs);
+	genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
 	genl_dumpit_info_free(info);
 	return rc;
 }
@@ -555,7 +557,7 @@ static int genl_parallel_done(struct netlink_callback *cb)
 
 	if (ops->done)
 		rc = ops->done(cb);
-	genl_family_rcv_msg_attrs_free(info->family, info->attrs);
+	genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
 	genl_dumpit_info_free(info);
 	return rc;
 }
@@ -585,7 +587,8 @@ static int genl_family_rcv_msg_dumpit(const struct genl_family *family,
 
 	attrs = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
 						ops, hdrlen,
-						GENL_DONT_VALIDATE_DUMP_STRICT);
+						GENL_DONT_VALIDATE_DUMP_STRICT,
+						true);
 	if (IS_ERR(attrs))
 		return PTR_ERR(attrs);
 
@@ -593,7 +596,7 @@ static int genl_family_rcv_msg_dumpit(const struct genl_family *family,
 	/* Allocate dumpit info. It is going to be freed by done() callback. */
 	info = genl_dumpit_info_alloc();
 	if (!info) {
-		genl_family_rcv_msg_attrs_free(family, attrs);
+		genl_family_rcv_msg_attrs_free(family, attrs, true);
 		return -ENOMEM;
 	}
 
@@ -645,7 +648,9 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family,
 
 	attrbuf = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
 						  ops, hdrlen,
-						  GENL_DONT_VALIDATE_STRICT);
+						  GENL_DONT_VALIDATE_STRICT,
+						  family->maxattr &&
+						  family->parallel_ops);
 	if (IS_ERR(attrbuf))
 		return PTR_ERR(attrbuf);
 
@@ -671,7 +676,8 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family,
 		family->post_doit(ops, skb, &info);
 
 out:
-	genl_family_rcv_msg_attrs_free(family, attrbuf);
+	genl_family_rcv_msg_attrs_free(family, attrbuf,
+				       family->maxattr && family->parallel_ops);
 
 	return err;
 }
-- 
2.21.0