GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-22 14:41:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

netlink: fix policy dump leak

Browse source 
[ Upstream commit a95bc734e6 ]

If userspace doesn't complete the policy dump, we leak the
allocated state. Fix this.

Fixes: d07dcf9aad ("netlink: add infrastructure to expose policies to userspace")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Johannes Berg 2020-10-02 09:46:04 +02:00 • committed by David S. Miller
parent 360f898746
commit 949ca6b82e
3 changed files with 20 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

3
include/net/netlink.h
View file

@ -1938,7 +1938,8 @@ void nla_get_range_signed(const struct nla_policy *pt,
int netlink_policy_dump_start(const struct nla_policy *policy, int netlink_policy_dump_start(const struct nla_policy *policy,
unsigned int maxtype, unsigned int maxtype,
unsigned long *state); unsigned long *state);
bool netlink_policy_dump_loop(unsigned long *state); bool netlink_policy_dump_loop(unsigned long state);
int netlink_policy_dump_write(struct sk_buff *skb, unsigned long state); int netlink_policy_dump_write(struct sk_buff *skb, unsigned long state);
void netlink_policy_dump_free(unsigned long state);
#endif #endif

9
net/netlink/genetlink.c
View file

@ -1079,7 +1079,7 @@ static int ctrl_dumppolicy(struct sk_buff *skb, struct netlink_callback *cb)
if (err) if (err)
return err; return err;
while (netlink_policy_dump_loop(&cb->args[1])) { while (netlink_policy_dump_loop(cb->args[1])) {
void *hdr; void *hdr;
struct nlattr *nest; struct nlattr *nest;
@ -1113,6 +1113,12 @@ nla_put_failure:
return skb->len; return skb->len;
} }
static int ctrl_dumppolicy_done(struct netlink_callback *cb)
{
netlink_policy_dump_free(cb->args[1]);
return 0;
}
static const struct genl_ops genl_ctrl_ops[] = { static const struct genl_ops genl_ctrl_ops[] = {
{ {
.cmd = CTRL_CMD_GETFAMILY, .cmd = CTRL_CMD_GETFAMILY,
@ -1123,6 +1129,7 @@ static const struct genl_ops genl_ctrl_ops[] = {
{ {
.cmd = CTRL_CMD_GETPOLICY, .cmd = CTRL_CMD_GETPOLICY,
.dumpit = ctrl_dumppolicy, .dumpit = ctrl_dumppolicy,
.done = ctrl_dumppolicy_done,
}, },
}; };

24
net/netlink/policy.c
View file

@ -84,7 +84,6 @@ int netlink_policy_dump_start(const struct nla_policy *policy,
unsigned int policy_idx; unsigned int policy_idx;
int err; int err;
/* also returns 0 if "*_state" is our ERR_PTR() end marker */
if (*_state) if (*_state)
return 0; return 0;
@ -140,21 +139,11 @@ static bool netlink_policy_dump_finished(struct nl_policy_dump *state)
!state->policies[state->policy_idx].policy; !state->policies[state->policy_idx].policy;
} }
bool netlink_policy_dump_loop(unsigned long *_state) bool netlink_policy_dump_loop(unsigned long _state)
{ {
struct nl_policy_dump *state = (void *)*_state; struct nl_policy_dump *state = (void *)_state;
if (IS_ERR(state)) return !netlink_policy_dump_finished(state);
return false;
if (netlink_policy_dump_finished(state)) {
kfree(state);
/* store end marker instead of freed state */
*_state = (unsigned long)ERR_PTR(-ENOENT);
return false;
}
return true;
} }
int netlink_policy_dump_write(struct sk_buff *skb, unsigned long _state) int netlink_policy_dump_write(struct sk_buff *skb, unsigned long _state)
@ -316,3 +305,10 @@ nla_put_failure:
nla_nest_cancel(skb, policy); nla_nest_cancel(skb, policy);
return -ENOBUFS; return -ENOBUFS;
} }
void netlink_policy_dump_free(unsigned long _state)
{
struct nl_policy_dump *state = (void *)_state;
kfree(state);
}