mirror of
https://github.com/torvalds/linux.git
synced 2024-11-29 23:51:37 +00:00
72a0b32911
Blamed commit added back a bug I fixed in commit9bbd917e0b
("vlan: fix memory leak in vlan_dev_set_egress_priority") If a memory allocation fails in vlan_changelink() after other allocations succeeded, we need to call vlan_dev_free_egress_priority() to free all allocated memory because after a failed ->newlink() we do not call any methods like ndo_uninit() or dev->priv_destructor(). In following example, if the allocation for last element 2000:2001 fails, we need to free eight prior allocations: ip link add link dummy0 dummy0.100 type vlan id 100 \ egress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001 syzbot report was: BUG: memory leak unreferenced object 0xffff888117bd1060 (size 32): comm "syz-executor408", pid 3759, jiffies 4294956555 (age 34.090s) hex dump (first 32 bytes): 09 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83fc60ad>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff83fc60ad>] vlan_dev_set_egress_priority+0xed/0x170 net/8021q/vlan_dev.c:193 [<ffffffff83fc6628>] vlan_changelink+0x178/0x1d0 net/8021q/vlan_netlink.c:128 [<ffffffff83fc67c8>] vlan_newlink+0x148/0x260 net/8021q/vlan_netlink.c:185 [<ffffffff838b1278>] rtnl_newlink_create net/core/rtnetlink.c:3363 [inline] [<ffffffff838b1278>] __rtnl_newlink+0xa58/0xdc0 net/core/rtnetlink.c:3580 [<ffffffff838b1629>] rtnl_newlink+0x49/0x70 net/core/rtnetlink.c:3593 [<ffffffff838ac66c>] rtnetlink_rcv_msg+0x21c/0x5c0 net/core/rtnetlink.c:6089 [<ffffffff839f9c37>] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2501 [<ffffffff839f8da7>] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [<ffffffff839f8da7>] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [<ffffffff839f9266>] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [<ffffffff8384dbf6>] sock_sendmsg_nosec net/socket.c:714 [inline] [<ffffffff8384dbf6>] sock_sendmsg+0x56/0x80 net/socket.c:734 [<ffffffff8384e15c>] ____sys_sendmsg+0x36c/0x390 net/socket.c:2488 [<ffffffff838523cb>] ___sys_sendmsg+0x8b/0xd0 net/socket.c:2542 [<ffffffff838525b8>] __sys_sendmsg net/socket.c:2571 [inline] [<ffffffff838525b8>] __do_sys_sendmsg net/socket.c:2580 [inline] [<ffffffff838525b8>] __se_sys_sendmsg net/socket.c:2578 [inline] [<ffffffff838525b8>] __x64_sys_sendmsg+0x78/0xf0 net/socket.c:2578 [<ffffffff845ad8d5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff845ad8d5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff8460006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fixes:37aa50c539
("vlan: introduce vlan_dev_free_egress_priority") Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Xin Long <lucien.xin@gmail.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
313 lines
7.8 KiB
C
313 lines
7.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* VLAN netlink control interface
|
|
*
|
|
* Copyright (c) 2007 Patrick McHardy <kaber@trash.net>
|
|
*/
|
|
|
|
#include <linux/kernel.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/if_vlan.h>
|
|
#include <linux/module.h>
|
|
#include <net/net_namespace.h>
|
|
#include <net/netlink.h>
|
|
#include <net/rtnetlink.h>
|
|
#include "vlan.h"
|
|
|
|
|
|
static const struct nla_policy vlan_policy[IFLA_VLAN_MAX + 1] = {
|
|
[IFLA_VLAN_ID] = { .type = NLA_U16 },
|
|
[IFLA_VLAN_FLAGS] = { .len = sizeof(struct ifla_vlan_flags) },
|
|
[IFLA_VLAN_EGRESS_QOS] = { .type = NLA_NESTED },
|
|
[IFLA_VLAN_INGRESS_QOS] = { .type = NLA_NESTED },
|
|
[IFLA_VLAN_PROTOCOL] = { .type = NLA_U16 },
|
|
};
|
|
|
|
static const struct nla_policy vlan_map_policy[IFLA_VLAN_QOS_MAX + 1] = {
|
|
[IFLA_VLAN_QOS_MAPPING] = { .len = sizeof(struct ifla_vlan_qos_mapping) },
|
|
};
|
|
|
|
|
|
static inline int vlan_validate_qos_map(struct nlattr *attr)
|
|
{
|
|
if (!attr)
|
|
return 0;
|
|
return nla_validate_nested_deprecated(attr, IFLA_VLAN_QOS_MAX,
|
|
vlan_map_policy, NULL);
|
|
}
|
|
|
|
static int vlan_validate(struct nlattr *tb[], struct nlattr *data[],
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct ifla_vlan_flags *flags;
|
|
u16 id;
|
|
int err;
|
|
|
|
if (tb[IFLA_ADDRESS]) {
|
|
if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) {
|
|
NL_SET_ERR_MSG_MOD(extack, "Invalid link address");
|
|
return -EINVAL;
|
|
}
|
|
if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) {
|
|
NL_SET_ERR_MSG_MOD(extack, "Invalid link address");
|
|
return -EADDRNOTAVAIL;
|
|
}
|
|
}
|
|
|
|
if (!data) {
|
|
NL_SET_ERR_MSG_MOD(extack, "VLAN properties not specified");
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (data[IFLA_VLAN_PROTOCOL]) {
|
|
switch (nla_get_be16(data[IFLA_VLAN_PROTOCOL])) {
|
|
case htons(ETH_P_8021Q):
|
|
case htons(ETH_P_8021AD):
|
|
break;
|
|
default:
|
|
NL_SET_ERR_MSG_MOD(extack, "Invalid VLAN protocol");
|
|
return -EPROTONOSUPPORT;
|
|
}
|
|
}
|
|
|
|
if (data[IFLA_VLAN_ID]) {
|
|
id = nla_get_u16(data[IFLA_VLAN_ID]);
|
|
if (id >= VLAN_VID_MASK) {
|
|
NL_SET_ERR_MSG_MOD(extack, "Invalid VLAN id");
|
|
return -ERANGE;
|
|
}
|
|
}
|
|
if (data[IFLA_VLAN_FLAGS]) {
|
|
flags = nla_data(data[IFLA_VLAN_FLAGS]);
|
|
if ((flags->flags & flags->mask) &
|
|
~(VLAN_FLAG_REORDER_HDR | VLAN_FLAG_GVRP |
|
|
VLAN_FLAG_LOOSE_BINDING | VLAN_FLAG_MVRP |
|
|
VLAN_FLAG_BRIDGE_BINDING)) {
|
|
NL_SET_ERR_MSG_MOD(extack, "Invalid VLAN flags");
|
|
return -EINVAL;
|
|
}
|
|
}
|
|
|
|
err = vlan_validate_qos_map(data[IFLA_VLAN_INGRESS_QOS]);
|
|
if (err < 0) {
|
|
NL_SET_ERR_MSG_MOD(extack, "Invalid ingress QOS map");
|
|
return err;
|
|
}
|
|
err = vlan_validate_qos_map(data[IFLA_VLAN_EGRESS_QOS]);
|
|
if (err < 0) {
|
|
NL_SET_ERR_MSG_MOD(extack, "Invalid egress QOS map");
|
|
return err;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int vlan_changelink(struct net_device *dev, struct nlattr *tb[],
|
|
struct nlattr *data[],
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct ifla_vlan_flags *flags;
|
|
struct ifla_vlan_qos_mapping *m;
|
|
struct nlattr *attr;
|
|
int rem, err;
|
|
|
|
if (data[IFLA_VLAN_FLAGS]) {
|
|
flags = nla_data(data[IFLA_VLAN_FLAGS]);
|
|
err = vlan_dev_change_flags(dev, flags->flags, flags->mask);
|
|
if (err)
|
|
return err;
|
|
}
|
|
if (data[IFLA_VLAN_INGRESS_QOS]) {
|
|
nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) {
|
|
m = nla_data(attr);
|
|
vlan_dev_set_ingress_priority(dev, m->to, m->from);
|
|
}
|
|
}
|
|
if (data[IFLA_VLAN_EGRESS_QOS]) {
|
|
nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) {
|
|
m = nla_data(attr);
|
|
err = vlan_dev_set_egress_priority(dev, m->from, m->to);
|
|
if (err)
|
|
return err;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int vlan_newlink(struct net *src_net, struct net_device *dev,
|
|
struct nlattr *tb[], struct nlattr *data[],
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
|
|
struct net_device *real_dev;
|
|
unsigned int max_mtu;
|
|
__be16 proto;
|
|
int err;
|
|
|
|
if (!data[IFLA_VLAN_ID]) {
|
|
NL_SET_ERR_MSG_MOD(extack, "VLAN id not specified");
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (!tb[IFLA_LINK]) {
|
|
NL_SET_ERR_MSG_MOD(extack, "link not specified");
|
|
return -EINVAL;
|
|
}
|
|
|
|
real_dev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
|
|
if (!real_dev) {
|
|
NL_SET_ERR_MSG_MOD(extack, "link does not exist");
|
|
return -ENODEV;
|
|
}
|
|
|
|
if (data[IFLA_VLAN_PROTOCOL])
|
|
proto = nla_get_be16(data[IFLA_VLAN_PROTOCOL]);
|
|
else
|
|
proto = htons(ETH_P_8021Q);
|
|
|
|
vlan->vlan_proto = proto;
|
|
vlan->vlan_id = nla_get_u16(data[IFLA_VLAN_ID]);
|
|
vlan->real_dev = real_dev;
|
|
dev->priv_flags |= (real_dev->priv_flags & IFF_XMIT_DST_RELEASE);
|
|
vlan->flags = VLAN_FLAG_REORDER_HDR;
|
|
|
|
err = vlan_check_real_dev(real_dev, vlan->vlan_proto, vlan->vlan_id,
|
|
extack);
|
|
if (err < 0)
|
|
return err;
|
|
|
|
max_mtu = netif_reduces_vlan_mtu(real_dev) ? real_dev->mtu - VLAN_HLEN :
|
|
real_dev->mtu;
|
|
if (!tb[IFLA_MTU])
|
|
dev->mtu = max_mtu;
|
|
else if (dev->mtu > max_mtu)
|
|
return -EINVAL;
|
|
|
|
/* Note: If this initial vlan_changelink() fails, we need
|
|
* to call vlan_dev_free_egress_priority() to free memory.
|
|
*/
|
|
err = vlan_changelink(dev, tb, data, extack);
|
|
|
|
if (!err)
|
|
err = register_vlan_dev(dev, extack);
|
|
|
|
if (err)
|
|
vlan_dev_free_egress_priority(dev);
|
|
return err;
|
|
}
|
|
|
|
static inline size_t vlan_qos_map_size(unsigned int n)
|
|
{
|
|
if (n == 0)
|
|
return 0;
|
|
/* IFLA_VLAN_{EGRESS,INGRESS}_QOS + n * IFLA_VLAN_QOS_MAPPING */
|
|
return nla_total_size(sizeof(struct nlattr)) +
|
|
nla_total_size(sizeof(struct ifla_vlan_qos_mapping)) * n;
|
|
}
|
|
|
|
static size_t vlan_get_size(const struct net_device *dev)
|
|
{
|
|
struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
|
|
|
|
return nla_total_size(2) + /* IFLA_VLAN_PROTOCOL */
|
|
nla_total_size(2) + /* IFLA_VLAN_ID */
|
|
nla_total_size(sizeof(struct ifla_vlan_flags)) + /* IFLA_VLAN_FLAGS */
|
|
vlan_qos_map_size(vlan->nr_ingress_mappings) +
|
|
vlan_qos_map_size(vlan->nr_egress_mappings);
|
|
}
|
|
|
|
static int vlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
|
|
{
|
|
struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
|
|
struct vlan_priority_tci_mapping *pm;
|
|
struct ifla_vlan_flags f;
|
|
struct ifla_vlan_qos_mapping m;
|
|
struct nlattr *nest;
|
|
unsigned int i;
|
|
|
|
if (nla_put_be16(skb, IFLA_VLAN_PROTOCOL, vlan->vlan_proto) ||
|
|
nla_put_u16(skb, IFLA_VLAN_ID, vlan->vlan_id))
|
|
goto nla_put_failure;
|
|
if (vlan->flags) {
|
|
f.flags = vlan->flags;
|
|
f.mask = ~0;
|
|
if (nla_put(skb, IFLA_VLAN_FLAGS, sizeof(f), &f))
|
|
goto nla_put_failure;
|
|
}
|
|
if (vlan->nr_ingress_mappings) {
|
|
nest = nla_nest_start_noflag(skb, IFLA_VLAN_INGRESS_QOS);
|
|
if (nest == NULL)
|
|
goto nla_put_failure;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(vlan->ingress_priority_map); i++) {
|
|
if (!vlan->ingress_priority_map[i])
|
|
continue;
|
|
|
|
m.from = i;
|
|
m.to = vlan->ingress_priority_map[i];
|
|
if (nla_put(skb, IFLA_VLAN_QOS_MAPPING,
|
|
sizeof(m), &m))
|
|
goto nla_put_failure;
|
|
}
|
|
nla_nest_end(skb, nest);
|
|
}
|
|
|
|
if (vlan->nr_egress_mappings) {
|
|
nest = nla_nest_start_noflag(skb, IFLA_VLAN_EGRESS_QOS);
|
|
if (nest == NULL)
|
|
goto nla_put_failure;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(vlan->egress_priority_map); i++) {
|
|
for (pm = vlan->egress_priority_map[i]; pm;
|
|
pm = pm->next) {
|
|
if (!pm->vlan_qos)
|
|
continue;
|
|
|
|
m.from = pm->priority;
|
|
m.to = (pm->vlan_qos >> 13) & 0x7;
|
|
if (nla_put(skb, IFLA_VLAN_QOS_MAPPING,
|
|
sizeof(m), &m))
|
|
goto nla_put_failure;
|
|
}
|
|
}
|
|
nla_nest_end(skb, nest);
|
|
}
|
|
return 0;
|
|
|
|
nla_put_failure:
|
|
return -EMSGSIZE;
|
|
}
|
|
|
|
static struct net *vlan_get_link_net(const struct net_device *dev)
|
|
{
|
|
struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
|
|
|
|
return dev_net(real_dev);
|
|
}
|
|
|
|
struct rtnl_link_ops vlan_link_ops __read_mostly = {
|
|
.kind = "vlan",
|
|
.maxtype = IFLA_VLAN_MAX,
|
|
.policy = vlan_policy,
|
|
.priv_size = sizeof(struct vlan_dev_priv),
|
|
.setup = vlan_setup,
|
|
.validate = vlan_validate,
|
|
.newlink = vlan_newlink,
|
|
.changelink = vlan_changelink,
|
|
.dellink = unregister_vlan_dev,
|
|
.get_size = vlan_get_size,
|
|
.fill_info = vlan_fill_info,
|
|
.get_link_net = vlan_get_link_net,
|
|
};
|
|
|
|
int __init vlan_netlink_init(void)
|
|
{
|
|
return rtnl_link_register(&vlan_link_ops);
|
|
}
|
|
|
|
void __exit vlan_netlink_fini(void)
|
|
{
|
|
rtnl_link_unregister(&vlan_link_ops);
|
|
}
|
|
|
|
MODULE_ALIAS_RTNL_LINK("vlan");
|