linux-toradex.git/include/net/netlink.h, branch v2.6.27.3

netlink: fix overrun in attribute iteration

2008-09-12T02:05:29+00:00

kmemcheck reported this:

  kmemcheck: Caught 16-bit read from uninitialized memory (f6c1ba30)
  0500110001508abf050010000500000002017300140000006f72672e66726565
   i i i i i i i i i i i i i u u u u u u u u u u u u u u u u u u u
                                   ^

  Pid: 3462, comm: wpa_supplicant Not tainted (2.6.27-rc3-00054-g6397ab9-dirty #13)
  EIP: 0060:[] EFLAGS: 00010296 CPU: 0
  EIP is at nla_parse+0x5a/0xf0
  EAX: 00000008 EBX: fffffffd ECX: c06f16c0 EDX: 00000005
  ESI: 00000010 EDI: f6c1ba30 EBP: f6367c6c ESP: c0a11e88
   DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
  CR0: 8005003b CR2: f781cc84 CR3: 3632f000 CR4: 000006d0
  DR0: c0ead9bc DR1: 00000000 DR2: 00000000 DR3: 00000000
  DR6: ffff4ff0 DR7: 00000400
   [] rtnl_setlink+0x63/0x130
   [] rtnetlink_rcv_msg+0x165/0x200
   [] netlink_rcv_skb+0x76/0xa0
   [] rtnetlink_rcv+0x1e/0x30
   [] netlink_unicast+0x281/0x290
   [] netlink_sendmsg+0x1b9/0x2b0
   [] sock_sendmsg+0xd2/0x100
   [] sys_sendto+0xa5/0xd0
   [] sys_send+0x36/0x40
   [] sys_socketcall+0x1e6/0x2c0
   [] sysenter_do_call+0x12/0x3f
   [] 0xffffffff

This is the line in nla_ok():

  /**
   * nla_ok - check if the netlink attribute fits into the remaining bytes
   * @nla: netlink attribute
   * @remaining: number of bytes remaining in attribute stream
   */
  static inline int nla_ok(const struct nlattr *nla, int remaining)
  {
          return remaining >= sizeof(*nla) &&
                 nla->nla_len >= sizeof(*nla) &&
                 nla->nla_len <= remaining;
  }

It turns out that remaining can become negative due to alignment in
nla_next(). But GCC promotes "remaining" to unsigned in the test
against sizeof(*nla) above. Therefore the test succeeds, and the
nla_for_each_attr() may access memory outside the received buffer.

A short example illustrating this point is here:

  #include 

  main(void)
  {
          printf("%d\n", -1 >= sizeof(int));
  }

...which prints "1".

This patch adds a cast in front of the sizeof so that GCC will make
a signed comparison and fix the illegal memory dereference. With the
patch applied, there is no kmemcheck report.

Signed-off-by: Vegard Nossum 
Acked-by: Thomas Graf 
Signed-off-by: David S. Miller

netlink: add NLA_PUT_BE64 macro

2008-07-21T17:10:58+00:00

Add NLA_PUT_BE64 macro required for 64bit counters in netfilter

Signed-off-by: Krzysztof Piotr Oledzki 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

netlink: Improve returned error codes

2008-06-03T23:36:54+00:00

Make nlmsg_trim(), nlmsg_cancel(), genlmsg_cancel(), and
nla_nest_cancel() void functions.

Return -EMSGSIZE instead of -1 if the provided message buffer is not
big enough.

Signed-off-by: Thomas Graf 
Signed-off-by: David S. Miller

netlink: Fix nla_parse_nested_compat() to call nla_parse() directly

2008-05-22T17:48:59+00:00

The purpose of nla_parse_nested_compat() is to parse attributes which
contain a struct followed by a stream of nested attributes.  So far,
it called nla_parse_nested() to parse the stream of nested attributes
which was wrong, as nla_parse_nested() expects a container attribute
as data which holds the attribute stream.  It needs to call
nla_parse() directly while pointing at the next possible alignment
point after the struct in the beginning of the attribute.

With this patch, I can no longer reproduce the reported leftover
warnings.

Signed-off-by: Thomas Graf 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETLINK]: Add nla_append()

2008-01-28T23:11:09+00:00

Used to append data to a message without a header or padding.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETNS]: Add netns to nl_info structure.

2008-01-28T23:01:29+00:00

nl_info is used to track the end-user destination of routing change
notification. This is a natural object to hold a namespace on. Place
it there and utilize the context in the appropriate places.

Acked-by: Benjamin Thery 
Acked-by: Daniel Lezcano 
Signed-off-by: Denis V. Lunev 
Signed-off-by: David S. Miller

[NETLINK]: Add NLA_PUT_BE16/nla_get_be16()

2008-01-28T22:58:53+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NETLINK]: Mark attribute construction exception unlikely

2008-01-28T22:56:34+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[NET]: make netlink user -> kernel interface synchronious

2007-10-11T04:15:29+00:00

This patch make processing netlink user -> kernel messages synchronious.
This change was inspired by the talk with Alexey Kuznetsov about current
netlink messages processing. He says that he was badly wrong when introduced 
asynchronious user -> kernel communication.

The call netlink_unicast is the only path to send message to the kernel
netlink socket. But, unfortunately, it is also used to send data to the
user.

Before this change the user message has been attached to the socket queue
and sk->sk_data_ready was called. The process has been blocked until all
pending messages were processed. The bad thing is that this processing
may occur in the arbitrary process context.

This patch changes nlk->data_ready callback to get 1 skb and force packet
processing right in the netlink_unicast.

Kernel -> user path in netlink_unicast remains untouched.

EINTR processing for in netlink_run_queue was changed. It forces rtnl_lock
drop, but the process remains in the cycle until the message will be fully
processed. So, there is no need to use this kludges now.

Signed-off-by: Denis V. Lunev 
Acked-by: Alexey Kuznetsov 
Signed-off-by: David S. Miller

[NETLINK]: Fix typos in comments in netlink.h

2007-10-11T04:09:48+00:00

This patch fixes a few typos in comments in include/net/netlink.h

Signed-off-by: Pierre Ynard 
Signed-off-by: David S. Miller