leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netlink: access nlk groups safely in netlink bind and getname

Browse Source 
Now there is no lock protecting nlk ngroups/groups' accessing in
netlink bind and getname. It's safe from nlk groups' setting in
netlink_release, but not from netlink_realloc_groups called by
netlink_setsockopt.

netlink_lock_table is needed in both netlink bind and getname when
accessing nlk groups.

Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Xin Long 2017-09-06 11:53:29 +08:00 committed by David S. Miller
parent be82485fbc
commit f773608026
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
net/netlink/af_netlink.c
View File

@ -955,7 +955,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
struct net *net = sock_net(sk); struct net *net = sock_net(sk);
struct netlink_sock *nlk = nlk_sk(sk); struct netlink_sock *nlk = nlk_sk(sk);
struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr; struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
int err; int err = 0;
long unsigned int groups = nladdr->nl_groups; long unsigned int groups = nladdr->nl_groups;
bool bound; bool bound;
@ -983,6 +983,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
return -EINVAL; return -EINVAL;
} }
netlink_lock_table();
if (nlk->netlink_bind && groups) { if (nlk->netlink_bind && groups) {
int group; int group;
@ -993,7 +994,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
if (!err) if (!err)
continue; continue;
netlink_undo_bind(group, groups, sk); netlink_undo_bind(group, groups, sk);
return err; goto unlock;
} }
} }
@ -1006,12 +1007,13 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
netlink_autobind(sock); netlink_autobind(sock);
if (err) { if (err) {
netlink_undo_bind(nlk->ngroups, groups, sk); netlink_undo_bind(nlk->ngroups, groups, sk);
return err; goto unlock;
} }
} }
if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0])) if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))
return 0; goto unlock;
netlink_unlock_table();
netlink_table_grab(); netlink_table_grab();
netlink_update_subscriptions(sk, nlk->subscriptions + netlink_update_subscriptions(sk, nlk->subscriptions +
@ -1022,6 +1024,10 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
netlink_table_ungrab(); netlink_table_ungrab();
return 0; return 0;
unlock:
netlink_unlock_table();
return err;
} }
static int netlink_connect(struct socket *sock, struct sockaddr *addr, static int netlink_connect(struct socket *sock, struct sockaddr *addr,
@ -1079,7 +1085,9 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr,
nladdr->nl_groups = netlink_group_mask(nlk->dst_group); nladdr->nl_groups = netlink_group_mask(nlk->dst_group);
} else { } else {
nladdr->nl_pid = nlk->portid; nladdr->nl_pid = nlk->portid;
netlink_lock_table();
nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0; nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;
netlink_unlock_table();
} }
return 0; return 0;
} }