summaryrefslogtreecommitdiffstats
path: root/net/netlink
diff options
context:
space:
mode:
authorJiri Pirko <jiri@mellanox.com>2019-10-08 12:31:43 +0200
committerJakub Kicinski <jakub.kicinski@netronome.com>2019-10-08 18:00:08 -0700
commitab5b526da0485ac4af3d395e5ce1c04b1bfbb89c (patch)
tree0dfc9c44e377d41c26efcdf4f0884e14f50d20e8 /net/netlink
parent48423dd7e683dadcfacc2bfb3bc0e57e7c8b9cb2 (diff)
downloadlinux-ab5b526da0485ac4af3d395e5ce1c04b1bfbb89c.tar.bz2
net: genetlink: always allocate separate attrs for dumpit ops
Individual dumpit ops (start, dumpit, done) are locked by genl_lock if !family->parallel_ops. However, multiple genl_family_rcv_msg_dumpit() calls may in in flight in parallel. Each has a separate struct genl_dumpit_info allocated but they share the same family->attrbuf. Fix this by allocating separate memory for attrs for dumpit ops, for non-parallel_ops (for parallel_ops it is done already). Reported-by: syzbot+495688b736534bb6c6ad@syzkaller.appspotmail.com Reported-by: syzbot+ff59dc711f2cff879a05@syzkaller.appspotmail.com Reported-by: syzbot+dbe02e13bcce52bcf182@syzkaller.appspotmail.com Reported-by: syzbot+9cb7edb2906ea1e83006@syzkaller.appspotmail.com Fixes: bf813b0afeae ("net: genetlink: parse attrs and store in contect info struct during dumpit") Signed-off-by: Jiri Pirko <jiri@mellanox.com> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Diffstat (limited to 'net/netlink')
-rw-r--r--net/netlink/genetlink.c28
1 files changed, 17 insertions, 11 deletions
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 1b5046436765..ecc2bd3e73e4 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -474,7 +474,8 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
struct netlink_ext_ack *extack,
const struct genl_ops *ops,
int hdrlen,
- enum genl_validate_flags no_strict_flag)
+ enum genl_validate_flags no_strict_flag,
+ bool parallel)
{
enum netlink_validation validate = ops->validate & no_strict_flag ?
NL_VALIDATE_LIBERAL :
@@ -482,7 +483,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
struct nlattr **attrbuf;
int err;
- if (family->maxattr && family->parallel_ops) {
+ if (parallel) {
attrbuf = kmalloc_array(family->maxattr + 1,
sizeof(struct nlattr *), GFP_KERNEL);
if (!attrbuf)
@@ -493,7 +494,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
err = __nlmsg_parse(nlh, hdrlen, attrbuf, family->maxattr,
family->policy, validate, extack);
- if (err && family->maxattr && family->parallel_ops) {
+ if (err && parallel) {
kfree(attrbuf);
return ERR_PTR(err);
}
@@ -501,9 +502,10 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
}
static void genl_family_rcv_msg_attrs_free(const struct genl_family *family,
- struct nlattr **attrbuf)
+ struct nlattr **attrbuf,
+ bool parallel)
{
- if (family->maxattr && family->parallel_ops)
+ if (parallel)
kfree(attrbuf);
}
@@ -542,7 +544,7 @@ static int genl_lock_done(struct netlink_callback *cb)
rc = ops->done(cb);
genl_unlock();
}
- genl_family_rcv_msg_attrs_free(info->family, info->attrs);
+ genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
genl_dumpit_info_free(info);
return rc;
}
@@ -555,7 +557,7 @@ static int genl_parallel_done(struct netlink_callback *cb)
if (ops->done)
rc = ops->done(cb);
- genl_family_rcv_msg_attrs_free(info->family, info->attrs);
+ genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
genl_dumpit_info_free(info);
return rc;
}
@@ -585,7 +587,8 @@ static int genl_family_rcv_msg_dumpit(const struct genl_family *family,
attrs = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
ops, hdrlen,
- GENL_DONT_VALIDATE_DUMP_STRICT);
+ GENL_DONT_VALIDATE_DUMP_STRICT,
+ true);
if (IS_ERR(attrs))
return PTR_ERR(attrs);
@@ -593,7 +596,7 @@ no_attrs:
/* Allocate dumpit info. It is going to be freed by done() callback. */
info = genl_dumpit_info_alloc();
if (!info) {
- genl_family_rcv_msg_attrs_free(family, attrs);
+ genl_family_rcv_msg_attrs_free(family, attrs, true);
return -ENOMEM;
}
@@ -645,7 +648,9 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family,
attrbuf = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
ops, hdrlen,
- GENL_DONT_VALIDATE_STRICT);
+ GENL_DONT_VALIDATE_STRICT,
+ family->maxattr &&
+ family->parallel_ops);
if (IS_ERR(attrbuf))
return PTR_ERR(attrbuf);
@@ -671,7 +676,8 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family,
family->post_doit(ops, skb, &info);
out:
- genl_family_rcv_msg_attrs_free(family, attrbuf);
+ genl_family_rcv_msg_attrs_free(family, attrbuf,
+ family->maxattr && family->parallel_ops);
return err;
}