lkml.org 
[lkml]   [2011]   [Apr]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[68/74] inet_diag: Make sure we actually run the same bytecode we audited.
    2.6.32-longterm review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Nelson Elhage <nelhage@ksplice.com>

    commit 22e76c849d505d87c5ecf3d3e6742a65f0ff4860 upstream.

    We were using nlmsg_find_attr() to look up the bytecode by attribute when
    auditing, but then just using the first attribute when actually running
    bytecode. So, if we received a message with two attribute elements, where only
    the second had type INET_DIAG_REQ_BYTECODE, we would validate and run different
    bytecode strings.

    Fix this by consistently using nlmsg_find_attr everywhere.

    Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
    Signed-off-by: Thomas Graf <tgraf@infradead.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [jmm: Slightly adapted to apply against 2.6.32]
    Cc: Moritz Muehlenhoff <jmm@debian.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


    ---
    net/ipv4/inet_diag.c | 27 ++++++++++++++++-----------
    1 file changed, 16 insertions(+), 11 deletions(-)

    --- a/net/ipv4/inet_diag.c
    +++ b/net/ipv4/inet_diag.c
    @@ -489,9 +489,11 @@ static int inet_csk_diag_dump(struct soc
    {
    struct inet_diag_req *r = NLMSG_DATA(cb->nlh);

    - if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
    + if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
    struct inet_diag_entry entry;
    - struct rtattr *bc = (struct rtattr *)(r + 1);
    + const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
    + sizeof(*r),
    + INET_DIAG_REQ_BYTECODE);
    struct inet_sock *inet = inet_sk(sk);

    entry.family = sk->sk_family;
    @@ -511,7 +513,7 @@ static int inet_csk_diag_dump(struct soc
    entry.dport = ntohs(inet->dport);
    entry.userlocks = sk->sk_userlocks;

    - if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
    + if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
    return 0;
    }

    @@ -526,9 +528,11 @@ static int inet_twsk_diag_dump(struct in
    {
    struct inet_diag_req *r = NLMSG_DATA(cb->nlh);

    - if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
    + if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
    struct inet_diag_entry entry;
    - struct rtattr *bc = (struct rtattr *)(r + 1);
    + const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
    + sizeof(*r),
    + INET_DIAG_REQ_BYTECODE);

    entry.family = tw->tw_family;
    #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
    @@ -547,7 +551,7 @@ static int inet_twsk_diag_dump(struct in
    entry.dport = ntohs(tw->tw_dport);
    entry.userlocks = 0;

    - if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
    + if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
    return 0;
    }

    @@ -617,7 +621,7 @@ static int inet_diag_dump_reqs(struct sk
    struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
    struct inet_connection_sock *icsk = inet_csk(sk);
    struct listen_sock *lopt;
    - struct rtattr *bc = NULL;
    + const struct nlattr *bc = NULL;
    struct inet_sock *inet = inet_sk(sk);
    int j, s_j;
    int reqnum, s_reqnum;
    @@ -637,8 +641,9 @@ static int inet_diag_dump_reqs(struct sk
    if (!lopt || !lopt->qlen)
    goto out;

    - if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
    - bc = (struct rtattr *)(r + 1);
    + if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
    + bc = nlmsg_find_attr(cb->nlh, sizeof(*r),
    + INET_DIAG_REQ_BYTECODE);
    entry.sport = inet->num;
    entry.userlocks = sk->sk_userlocks;
    }
    @@ -671,8 +676,8 @@ static int inet_diag_dump_reqs(struct sk
    &ireq->rmt_addr;
    entry.dport = ntohs(ireq->rmt_port);

    - if (!inet_diag_bc_run(RTA_DATA(bc),
    - RTA_PAYLOAD(bc), &entry))
    + if (!inet_diag_bc_run(nla_data(bc),
    + nla_len(bc), &entry))
    continue;
    }




    \
     
     \ /
      Last update: 2011-04-13 18:05    [W:4.247 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site