Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7736080 authored by Xin Long's avatar Xin Long Committed by David S. Miller
Browse files

netlink: access nlk groups safely in netlink bind and getname 



Now there is no lock protecting nlk ngroups/groups' accessing in
netlink bind and getname. It's safe from nlk groups' setting in
netlink_release, but not from netlink_realloc_groups called by
netlink_setsockopt.

netlink_lock_table is needed in both netlink bind and getname when
accessing nlk groups.

Acked-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent be82485f

net/netlink/af_netlink.c

+12 −4
Original line number Original line Diff line number Diff line
@@ -955,7 +955,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, 
	struct net *net = sock_net(sk);

	struct net *net = sock_net(sk);

	struct netlink_sock *nlk = nlk_sk(sk);

	struct netlink_sock *nlk = nlk_sk(sk);

	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;

	struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;

	int err;

	int err = 0;

	long unsigned int groups = nladdr->nl_groups;

	long unsigned int groups = nladdr->nl_groups;

	bool bound;

	bool bound;
@@ -983,6 +983,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, 
			return -EINVAL;

			return -EINVAL;

	}

	}





	netlink_lock_table();

	if (nlk->netlink_bind && groups) {

	if (nlk->netlink_bind && groups) {

		int group;

		int group;
@@ -993,7 +994,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, 
			if (!err)

			if (!err)

				continue;

				continue;

			netlink_undo_bind(group, groups, sk);

			netlink_undo_bind(group, groups, sk);

			return err;

			goto unlock;

		}

		}

	}

	}
@@ -1006,12 +1007,13 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, 
			netlink_autobind(sock);

			netlink_autobind(sock);

		if (err) {

		if (err) {

			netlink_undo_bind(nlk->ngroups, groups, sk);

			netlink_undo_bind(nlk->ngroups, groups, sk);

			return err;

			goto unlock;

		}

		}

	}

	}





	if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))

	if (!groups && (nlk->groups == NULL || !(u32)nlk->groups[0]))

		return 0;

		goto unlock;

	netlink_unlock_table();





	netlink_table_grab();

	netlink_table_grab();

	netlink_update_subscriptions(sk, nlk->subscriptions +

	netlink_update_subscriptions(sk, nlk->subscriptions +
@@ -1022,6 +1024,10 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, 
	netlink_table_ungrab();

	netlink_table_ungrab();





	return 0;

	return 0;



unlock:

	netlink_unlock_table();

	return err;

}

}





static int netlink_connect(struct socket *sock, struct sockaddr *addr,

static int netlink_connect(struct socket *sock, struct sockaddr *addr,
@@ -1079,7 +1085,9 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr, 
		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);

		nladdr->nl_groups = netlink_group_mask(nlk->dst_group);

	} else {

	} else {

		nladdr->nl_pid = nlk->portid;

		nladdr->nl_pid = nlk->portid;

		netlink_lock_table();

		nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;

		nladdr->nl_groups = nlk->groups ? nlk->groups[0] : 0;

		netlink_unlock_table();

	}

	}

	return 0;

	return 0;

}

}