Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9ef80994 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Greg Kroah-Hartman
Browse files

netlink: Use copy_to_user() for optval in netlink_getsockopt(). 



[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ]

Brad Spencer provided a detailed report [0] that when calling getsockopt()
for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such
options require at least sizeof(int) as length.

The options return a flag value that fits into 1 byte, but such behaviour
confuses users who do not initialise the variable before calling
getsockopt() and do not strictly check the returned value as char.

Currently, netlink_getsockopt() uses put_user() to copy data to optlen and
optval, but put_user() casts the data based on the pointer, char *optval.
As a result, only 1 byte is set to optval.

To avoid this behaviour, we need to use copy_to_user() or cast optval for
put_user().

Note that this changes the behaviour on big-endian systems, but we document
that the size of optval is int in the man page.

  $ man 7 netlink
  ...
  Socket options
       To set or get a netlink socket option, call getsockopt(2) to read
       or setsockopt(2) to write the option with the option level argument
       set to SOL_NETLINK.  Unless otherwise noted, optval is a pointer to
       an int.

Fixes: 9a4595bc ("[NETLINK]: Add set/getsockopt options to support more than 32 groups")
Fixes: be0c22a4 ("netlink: add NETLINK_BROADCAST_ERROR socket option")
Fixes: 38938bfe ("netlink: add NETLINK_NO_ENOBUFS socket flag")
Fixes: 0a6a3a23 ("netlink: add NETLINK_CAP_ACK socket option")
Fixes: 2d4bc933 ("netlink: extended ACK reporting")
Fixes: 89d35528 ("netlink: Add new socket option to enable strict checking on dumps")
Reported-by: default avatarBrad Spencer <bspencer@blackberry.com>
Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/


Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent de0ffb51

net/netlink/af_netlink.c

+23 −52
Original line number Diff line number Diff line
@@ -1743,7 +1743,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, 
{

	struct sock *sk = sock->sk;

	struct netlink_sock *nlk = nlk_sk(sk);

	int len, val, err;

	unsigned int flag;

	int len, val;



	if (level != SOL_NETLINK)

		return -ENOPROTOOPT;
@@ -1755,39 +1756,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, 


	switch (optname) {

	case NETLINK_PKTINFO:

		if (len < sizeof(int))

			return -EINVAL;

		len = sizeof(int);

		val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;

		if (put_user(len, optlen) ||

		    put_user(val, optval))

			return -EFAULT;

		err = 0;

		flag = NETLINK_F_RECV_PKTINFO;

		break;

	case NETLINK_BROADCAST_ERROR:

		if (len < sizeof(int))

			return -EINVAL;

		len = sizeof(int);

		val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;

		if (put_user(len, optlen) ||

		    put_user(val, optval))

			return -EFAULT;

		err = 0;

		flag = NETLINK_F_BROADCAST_SEND_ERROR;

		break;

	case NETLINK_NO_ENOBUFS:

		if (len < sizeof(int))

			return -EINVAL;

		len = sizeof(int);

		val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;

		if (put_user(len, optlen) ||

		    put_user(val, optval))

			return -EFAULT;

		err = 0;

		flag = NETLINK_F_RECV_NO_ENOBUFS;

		break;

	case NETLINK_LIST_MEMBERSHIPS: {

		int pos, idx, shift;

		int pos, idx, shift, err = 0;



		err = 0;

		netlink_lock_table();

		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {

			if (len - pos < sizeof(u32))
@@ -1804,40 +1783,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, 
		if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))

			err = -EFAULT;

		netlink_unlock_table();

		break;

		return err;

	}

	case NETLINK_CAP_ACK:

		if (len < sizeof(int))

			return -EINVAL;

		len = sizeof(int);

		val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;

		if (put_user(len, optlen) ||

		    put_user(val, optval))

			return -EFAULT;

		err = 0;

		flag = NETLINK_F_CAP_ACK;

		break;

	case NETLINK_EXT_ACK:

		if (len < sizeof(int))

			return -EINVAL;

		len = sizeof(int);

		val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;

		if (put_user(len, optlen) || put_user(val, optval))

			return -EFAULT;

		err = 0;

		flag = NETLINK_F_EXT_ACK;

		break;

	case NETLINK_GET_STRICT_CHK:

		flag = NETLINK_F_STRICT_CHK;

		break;

	default:

		return -ENOPROTOOPT;

	}



	if (len < sizeof(int))

		return -EINVAL;



	len = sizeof(int);

		val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0;

		if (put_user(len, optlen) || put_user(val, optval))

	val = nlk->flags & flag ? 1 : 0;



	if (put_user(len, optlen) ||

	    copy_to_user(optval, &val, len))

		return -EFAULT;

		err = 0;

		break;

	default:

		err = -ENOPROTOOPT;

	}

	return err;



	return 0;

}



static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)