netdev - Re: [PATCH net 1/3] rtnetlink: move validate_linkmsg into rtnl_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230529182511.0b138482@kernel.org>
Date: Mon, 29 May 2023 18:25:11 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Xin Long <lucien.xin@...il.com>
Cc: network dev <netdev@...r.kernel.org>, davem@...emloft.net, Eric Dumazet
 <edumazet@...gle.com>, Paolo Abeni <pabeni@...hat.com>, Thomas Graf
 <tgraf@...radead.org>, Alexander Duyck <alexanderduyck@...com>
Subject: Re: [PATCH net 1/3] rtnetlink: move validate_linkmsg into
 rtnl_create_link

On Sat, 27 May 2023 16:36:15 -0400 Xin Long wrote:
> Other than avoiding calling validation twice, adding validate_linkmsg() in
> rtnl_create_link() also fixes the missing validation for newly created links,
> it includes tb[IFLA_ADDRESS/IFLA_BROADCAST] checks in validate_linkmsg():

Ah, I see. Since this is a fix I'd err on the side of keeping the
change small and obvious and limit it to adding the call in
validate_linkmsg() without worrying about validating multiple times.
Then follow up with the refactoring to net-next. 
I guess it could be acceptable to take the whole thing into net, if
you prefer but at least the commit message would need clarification.

> As for the calling twice thing, validating before any changes happen
> makes sense.
> Based on the change in this patch, I will pull the validation out of
> do_setlink()
> to these 3 places:
> 
> @@ -3600,7 +3605,9 @@ static int __rtnl_newlink(struct sk_buff *skb,
> struct nlmsghdr *nlh,
>                         return -EEXIST;
>                 if (nlh->nlmsg_flags & NLM_F_REPLACE)
>                         return -EOPNOTSUPP;
> -
> +               err = validate_linkmsg(dev, tb, extack);
> +               if (err < 0)
> +                       return err;
> 
> @@ -3377,6 +3383,9 @@ static int rtnl_group_changelink(const struct
> sk_buff *skb,
> 
>         for_each_netdev_safe(net, dev, aux) {
>                 if (dev->group == group) {
> +                       err = validate_linkmsg(dev, tb, extack);
> +                       if (err < 0)
> +                               return err;
>                         err = do_setlink(skb, dev, ifm, extack, tb, 0);
> 
> @@ -3140,6 +3136,10 @@ static int rtnl_setlink(struct sk_buff *skb,
> struct nlmsghdr *nlh,
>                 goto errout;
>         }
> 
> +       err = validate_linkmsg(dev, tb, extack);
> +       if (err < 0)
> +               goto errout;
> +
>         err = do_setlink(skb, dev, ifm, extack, tb, 0);
> 
> 
> and yes, one more place calls validate_linkmsg (comparing to the old code
> with the one in rtnl_create_link), unless someone thinks it's not worth it.

Yup, LGTM. Renaming do_setlink() to __do_setlink() and adding a wrapper
called do_setlink() which does the validation and calls __do_setlink() -
seems like another option to explore. Whatever you reckon ends up
looking neatest. As long as the validation ends up moving towards 
the entry point not deeper in - any approach is fine.