netdev - [PATCH net-next] net: diag: add workaround for inode truncation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200831235956.2143127-1-kuba@kernel.org>
Date:   Mon, 31 Aug 2020 16:59:56 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     davem@...emloft.net
Cc:     netdev@...r.kernel.org, kernel-team@...com, zeil@...dex-team.ru,
        khlebnikov@...dex-team.ru, pabeni@...hat.com,
        Jakub Kicinski <kuba@...nel.org>,
        Dave Marchevsky <davemarchevsky@...com>
Subject: [PATCH net-next] net: diag: add workaround for inode truncation

Dave reports that struct inet_diag_msg::idiag_inode is 32 bit,
while inode's type is unsigned long. This leads to truncation.

Since there is nothing we can do about the size of existing
fields - add a new attribute to carry 64 bit inode numbers.

Reported-by: Dave Marchevsky <davemarchevsky@...com>
Signed-off-by: Jakub Kicinski <kuba@...nel.org>
---
 include/linux/inet_diag.h      | 1 +
 include/uapi/linux/inet_diag.h | 1 +
 net/ipv4/inet_diag.c           | 7 ++++++-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h
index 0ef2d800fda7..5ea0f965c173 100644
--- a/include/linux/inet_diag.h
+++ b/include/linux/inet_diag.h
@@ -75,6 +75,7 @@ static inline size_t inet_diag_msg_attrs_size(void)
 #ifdef CONFIG_SOCK_CGROUP_DATA
 		+ nla_total_size_64bit(sizeof(u64))  /* INET_DIAG_CGROUP_ID */
 #endif
+		+ nla_total_size_64bit(sizeof(u64))  /* INET_DIAG_INODE */
 		;
 }
 int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
index 5ba122c1949a..0819a473ee9c 100644
--- a/include/uapi/linux/inet_diag.h
+++ b/include/uapi/linux/inet_diag.h
@@ -160,6 +160,7 @@ enum {
 	INET_DIAG_ULP_INFO,
 	INET_DIAG_SK_BPF_STORAGES,
 	INET_DIAG_CGROUP_ID,
+	INET_DIAG_INODE,
 	__INET_DIAG_MAX,
 };
 
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 4a98dd736270..6a52947591fc 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -125,6 +125,7 @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
 			     bool net_admin)
 {
 	const struct inet_sock *inet = inet_sk(sk);
+	unsigned long ino;
 
 	if (nla_put_u8(skb, INET_DIAG_SHUTDOWN, sk->sk_shutdown))
 		goto errout;
@@ -177,8 +178,12 @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
 		goto errout;
 #endif
 
+	ino = sock_i_ino(sk);
+	if (nla_put_u64_64bit(skb, INET_DIAG_INODE, ino, INET_DIAG_PAD))
+		goto errout;
+
 	r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk));
-	r->idiag_inode = sock_i_ino(sk);
+	r->idiag_inode = ino;
 
 	return 0;
 errout:
-- 
2.26.2