lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

netlink: fix compat recvmsg

Browse Source 
Since
commit 1dacc76d00
Author: Johannes Berg <johannes@sipsolutions.net>
Date:   Wed Jul 1 11:26:02 2009 +0000

    net/compat/wext: send different messages to compat tasks

we had a race condition when setting and then
restoring frag_list. Eric attempted to fix it,
but the fix created even worse problems.

However, the original motivation I had when I
added the code that turned out to be racy is
no longer clear to me, since we only copy up
to skb->len to userspace, which doesn't include
the frag_list length. As a result, not doing
any frag_list clearing and restoring avoids
the race condition, while not introducing any
other problems.

Additionally, while preparing this patch I found
that since none of the remaining netlink code is
really aware of the frag_list, we need to use the
original skb's information for packet information
and credentials. This fixes, for example, the
group information received by compat tasks.

Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: stable@kernel.org [2.6.31+, for 2.6.35 revert 1235f504aa]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Johannes Berg
2010-08-15 21:20:44 +00:00
committed by David S. Miller
parent e243f5b6de
commit 68d6ac6d27
1 changed files with 16 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
net/netlink/af_netlink.c
View File

@@ -1406,7 +1406,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
struct netlink_sock *nlk = nlk_sk(sk); struct netlink_sock *nlk = nlk_sk(sk);
int noblock = flags&MSG_DONTWAIT; int noblock = flags&MSG_DONTWAIT;
size_t copied; size_t copied;
struct sk_buff *skb, *frag __maybe_unused = NULL; struct sk_buff *skb, *data_skb;
int err; int err;
if (flags&MSG_OOB) if (flags&MSG_OOB)
@@ -1418,45 +1418,35 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
if (skb == NULL) if (skb == NULL)
goto out; goto out;
data_skb = skb;
#ifdef CONFIG_COMPAT_NETLINK_MESSAGES #ifdef CONFIG_COMPAT_NETLINK_MESSAGES
if (unlikely(skb_shinfo(skb)->frag_list)) { if (unlikely(skb_shinfo(skb)->frag_list)) {
bool need_compat = !!(flags & MSG_CMSG_COMPAT);
/* /*
* If this skb has a frag_list, then here that means that * If this skb has a frag_list, then here that means that we
* we will have to use the frag_list skb for compat tasks * will have to use the frag_list skb's data for compat tasks
* and the regular skb for non-compat tasks. * and the regular skb's data for normal (non-compat) tasks.
* *
* The skb might (and likely will) be cloned, so we can't * If we need to send the compat skb, assign it to the
* just reset frag_list and go on with things -- we need to * 'data_skb' variable so that it will be used below for data
* keep that. For the compat case that's easy -- simply get * copying. We keep 'skb' for everything else, including
* a reference to the compat skb and free the regular one * freeing both later.
* including the frag. For the non-compat case, we need to
* avoid sending the frag to the user -- so assign NULL but
* restore it below before freeing the skb.
*/ */
if (need_compat) { if (flags & MSG_CMSG_COMPAT)
struct sk_buff *compskb = skb_shinfo(skb)->frag_list; data_skb = skb_shinfo(skb)->frag_list;
skb_get(compskb);
kfree_skb(skb);
skb = compskb;
} else {
frag = skb_shinfo(skb)->frag_list;
skb_shinfo(skb)->frag_list = NULL;
}
} }
#endif #endif
msg->msg_namelen = 0; msg->msg_namelen = 0;
copied = skb->len; copied = data_skb->len;
if (len < copied) { if (len < copied) {
msg->msg_flags |= MSG_TRUNC; msg->msg_flags |= MSG_TRUNC;
copied = len; copied = len;
} }
skb_reset_transport_header(skb); skb_reset_transport_header(data_skb);
err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); err = skb_copy_datagram_iovec(data_skb, 0, msg->msg_iov, copied);
if (msg->msg_name) { if (msg->msg_name) {
struct sockaddr_nl *addr = (struct sockaddr_nl *)msg->msg_name; struct sockaddr_nl *addr = (struct sockaddr_nl *)msg->msg_name;
@@ -1476,11 +1466,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
} }
siocb->scm->creds = *NETLINK_CREDS(skb); siocb->scm->creds = *NETLINK_CREDS(skb);
if (flags & MSG_TRUNC) if (flags & MSG_TRUNC)
copied = skb->len; copied = data_skb->len;
#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
skb_shinfo(skb)->frag_list = frag;
#endif
skb_free_datagram(sk, skb); skb_free_datagram(sk, skb);