netdev - RE: [PATCH net-next] genetlink: fix policy dump for dumps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CO1PR11MB5089F3CECB59624025A648A3D63F9@CO1PR11MB5089.namprd11.prod.outlook.com>
Date:   Tue, 8 Nov 2022 20:47:57 +0000
From:   "Keller, Jacob E" <jacob.e.keller@...el.com>
To:     Jakub Kicinski <kuba@...nel.org>,
        "davem@...emloft.net" <davem@...emloft.net>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "pabeni@...hat.com" <pabeni@...hat.com>,
        "Jonathan Lemon" <bsd@...a.com>
Subject: RE: [PATCH net-next] genetlink: fix policy dump for dumps



> -----Original Message-----
> From: Jakub Kicinski <kuba@...nel.org>
> Sent: Tuesday, November 8, 2022 12:41 PM
> To: davem@...emloft.net
> Cc: netdev@...r.kernel.org; edumazet@...gle.com; pabeni@...hat.com; Jakub
> Kicinski <kuba@...nel.org>; Jonathan Lemon <bsd@...a.com>; Keller, Jacob E
> <jacob.e.keller@...el.com>
> Subject: [PATCH net-next] genetlink: fix policy dump for dumps
> 
> Jonathan reports crashes when running net-next in Meta's fleet.
> Stats collection uses ethtool -I which does a per-op policy dump
> to check if stats are supported. We don't initialize the dumpit
> information if doit succeeds due to evaluation short-circuiting.
> 
> The crash may look like this:
> 
>    BUG: kernel NULL pointer dereference, address: 0000000000000cc0
>    RIP: 0010:netlink_policy_dump_add_policy+0x174/0x2a0
>      ctrl_dumppolicy_start+0x19f/0x2f0
>      genl_start+0xe7/0x140
> 
> Or we may trigger a warning:
> 
>    WARNING: CPU: 1 PID: 785 at net/netlink/policy.c:87
> netlink_policy_dump_get_policy_idx+0x79/0x80
>    RIP: 0010:netlink_policy_dump_get_policy_idx+0x79/0x80
>      ctrl_dumppolicy_put_op+0x214/0x360
> 
> depending on what garbage we pick up from the stack.
> 


Oops. Yay subtle bugs :D

> Reported-by: Jonathan Lemon <bsd@...a.com>
> Fixes: 26588edbef60 ("genetlink: support split policies in
> ctrl_dumppolicy_put_op()")
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> ---
> CC: jacob.e.keller@...el.com
> ---
>  net/netlink/genetlink.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
> index 9b7dfc45dd67..7b7bac9e7524 100644
> --- a/net/netlink/genetlink.c
> +++ b/net/netlink/genetlink.c
> @@ -1406,8 +1406,8 @@ static int ctrl_dumppolicy_start(struct netlink_callback
> *cb)
>  		ctx->single_op = true;
>  		ctx->op = nla_get_u32(tb[CTRL_ATTR_OP]);
> 
> -		if (genl_get_cmd(ctx->op, GENL_CMD_CAP_DO, rt, &doit) &&
> -		    genl_get_cmd(ctx->op, GENL_CMD_CAP_DUMP, rt, &dump)) {
> +		if (!!genl_get_cmd(ctx->op, GENL_CMD_CAP_DO, rt, &doit) +
> +		    !!genl_get_cmd(ctx->op, GENL_CMD_CAP_DUMP, rt, &dump) <
> 1) {


A little bit tricky code here, but it makes sense. We could rewrite this to be a bit more verbose like:

doit_err = genl_get_cmd(.. GENL_CMD_CAP_DO ..);
dumpit_err = genl_get_cmd(.. GENL_CMD_CAP_DUMPIT ..);
if (doit_err && dumpit_err) {
  ...
}

That might be a bit easier to read than the !! ( ) + ( ) < 1 notation.

Either way I think it looks correct at least.

Thanks,
Jake

>  			NL_SET_BAD_ATTR(cb->extack, tb[CTRL_ATTR_OP]);
>  			return -ENOENT;
>  		}
> @@ -1551,10 +1551,10 @@ static int ctrl_dumppolicy(struct sk_buff *skb, struct
> netlink_callback *cb)
>  		if (ctx->single_op) {
>  			struct genl_split_ops doit, dumpit;
> 
> -			if (genl_get_cmd(ctx->op, GENL_CMD_CAP_DO,
> -					 ctx->rt, &doit) &&
> -			    genl_get_cmd(ctx->op, GENL_CMD_CAP_DUMP,
> -					 ctx->rt, &dumpit)) {
> +			if (!!genl_get_cmd(ctx->op, GENL_CMD_CAP_DO,
> +					   ctx->rt, &doit) +
> +			    !!genl_get_cmd(ctx->op, GENL_CMD_CAP_DUMP,
> +					   ctx->rt, &dumpit) < 1) {
>  				WARN_ON(1);
>  				return -ENOENT;
>  			}
> --
> 2.38.1