Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9dfa1dfe authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_log: account for size of NLMSG_DONE attribute 



We currently neither account for the nlattr size, nor do we consider
the size of the trailing NLMSG_DONE when allocating nlmsg skb.

This can result in nflog to stop working, as __nfulnl_send() re-tries
sending forever if it failed to append NLMSG_DONE (which will never
work if buffer is not large enough).

Reported-by: default avatarHoucheng Lin <houcheng@gmail.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7677e868

net/netfilter/nfnetlink_log.c

+3 −3
Original line number Diff line number Diff line
@@ -649,7 +649,8 @@ nfulnl_log_packet(struct net *net, 
		+ nla_total_size(sizeof(u_int32_t))	/* gid */

		+ nla_total_size(plen)			/* prefix */

		+ nla_total_size(sizeof(struct nfulnl_msg_packet_hw))

		+ nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp));

		+ nla_total_size(sizeof(struct nfulnl_msg_packet_timestamp))

		+ nla_total_size(sizeof(struct nfgenmsg));	/* NLMSG_DONE */



	if (in && skb_mac_header_was_set(skb)) {

		size +=   nla_total_size(skb->dev->hard_header_len)
@@ -692,8 +693,7 @@ nfulnl_log_packet(struct net *net, 
		goto unlock_and_release;

	}



	if (inst->skb &&

	    size > skb_tailroom(inst->skb) - sizeof(struct nfgenmsg)) {

	if (inst->skb && size > skb_tailroom(inst->skb)) {

		/* either the queue len is too high or we don't have

		 * enough room in the skb left. flush to userspace. */

		__nfulnl_flush(inst);