OrgACRN
/
acrn-kernel
mirror of https://github.com/projectacrn/acrn-kernel.git
1
0
Fork 0
Code Issues Releases Wiki Activity

genetlink: reject use of nlmsg_flags for new commands 

Commit 9c5d03d362 ("genetlink: start to validate reserved header bytes")
introduced extra validation for genetlink headers. We had to gate it
to only apply to new commands, to maintain bug-wards compatibility.
Use this opportunity (before the new checks make it to Linus's tree)
to add more conditions.

Validate that Generic Netlink families do not use nlmsg_flags outside
of the well-understood set.

Link: https://lore.kernel.org/all/20220928073709.1b93b74a@kernel.org/
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20220929142809.1167546-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2022-09-29 07:28:09 -07:00
parent 915b96c527
commit cff2d762cd
1 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
net/netlink/genetlink.c
View File

@ -739,6 +739,36 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family,
return err;
}
static int genl_header_check(const struct genl_family *family,
struct nlmsghdr *nlh, struct genlmsghdr *hdr,
struct netlink_ext_ack *extack)
{
u16 flags;
/* Only for commands added after we started validating */
if (hdr->cmd < family->resv_start_op)
return 0;
if (hdr->reserved) {
NL_SET_ERR_MSG(extack, "genlmsghdr.reserved field is not 0");
return -EINVAL;
}
/* Old netlink flags have pretty loose semantics, allow only the flags
* consumed by the core where we can enforce the meaning.
*/
flags = nlh->nlmsg_flags;
if ((flags & NLM_F_DUMP) == NLM_F_DUMP) /* DUMP is 2 bits */
flags &= ~NLM_F_DUMP;
if (flags & ~(NLM_F_REQUEST | NLM_F_ACK | NLM_F_ECHO)) {
NL_SET_ERR_MSG(extack,
"ambiguous or reserved bits set in nlmsg_flags");
return -EINVAL;
}
return 0;
}
static int genl_family_rcv_msg(const struct genl_family *family,
struct sk_buff *skb,
struct nlmsghdr *nlh,
@ -757,7 +787,7 @@ static int genl_family_rcv_msg(const struct genl_family *family,
if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
return -EINVAL;
if (hdr->cmd >= family->resv_start_op && hdr->reserved)
if (genl_header_check(family, nlh, hdr, extack))
return -EINVAL;
if (genl_get_cmd(hdr->cmd, family, &op))