From: "David S. Miller" <davem@davemloft.net>
To: netdev@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Subject: [PATCH 10/51] nfnetlink_log: Stop using NLA_PUT*().
Date: Sun, 1 Apr 2012 22:58:00 -0400 [thread overview]
Message-ID: <1333335521-1348-11-git-send-email-davem@davemloft.net> (raw)
In-Reply-To: <1333335521-1348-1-git-send-email-davem@davemloft.net>
From: "David S. Miller" <davem@davemloft.net>
These macros contain a hidden goto, and are thus extremely error
prone and make code hard to audit.
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/netfilter/nfnetlink_log.c | 100 ++++++++++++++++++++++++-----------------
1 files changed, 58 insertions(+), 42 deletions(-)
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 66b2c54..3c3cfc0 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -391,67 +391,78 @@ __build_packet_message(struct nfulnl_instance *inst,
pmsg.hw_protocol = skb->protocol;
pmsg.hook = hooknum;
- NLA_PUT(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg);
+ if (nla_put(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg))
+ goto nla_put_failure;
- if (prefix)
- NLA_PUT(inst->skb, NFULA_PREFIX, plen, prefix);
+ if (prefix &&
+ nla_put(inst->skb, NFULA_PREFIX, plen, prefix))
+ goto nla_put_failure;
if (indev) {
#ifndef CONFIG_BRIDGE_NETFILTER
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_INDEV,
- htonl(indev->ifindex));
+ if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
+ htonl(indev->ifindex)))
+ goto nla_put_failure;
#else
if (pf == PF_BRIDGE) {
/* Case 1: outdev is physical input device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
- htonl(indev->ifindex));
+ if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+ htonl(indev->ifindex)) ||
/* this is the bridge group "brX" */
/* rcu_read_lock()ed by nf_hook_slow or nf_log_packet */
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_INDEV,
- htonl(br_port_get_rcu(indev)->br->dev->ifindex));
+ nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
+ htonl(br_port_get_rcu(indev)->br->dev->ifindex)))
+ goto nla_put_failure;
} else {
/* Case 2: indev is bridge group, we need to look for
* physical device (when called from ipv4) */
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_INDEV,
- htonl(indev->ifindex));
- if (skb->nf_bridge && skb->nf_bridge->physindev)
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
- htonl(skb->nf_bridge->physindev->ifindex));
+ if (nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV,
+ htonl(indev->ifindex)))
+ goto nla_put_failure;
+ if (skb->nf_bridge && skb->nf_bridge->physindev &&
+ nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSINDEV,
+ htonl(skb->nf_bridge->physindev->ifindex)))
+ goto nla_put_failure;
}
#endif
}
if (outdev) {
#ifndef CONFIG_BRIDGE_NETFILTER
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_OUTDEV,
- htonl(outdev->ifindex));
+ if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
+ htonl(outdev->ifindex)))
+ goto nla_put_failure;
#else
if (pf == PF_BRIDGE) {
/* Case 1: outdev is physical output device, we need to
* look for bridge group (when called from
* netfilter_bridge) */
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
- htonl(outdev->ifindex));
+ if (nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+ htonl(outdev->ifindex)) ||
/* this is the bridge group "brX" */
/* rcu_read_lock()ed by nf_hook_slow or nf_log_packet */
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_OUTDEV,
- htonl(br_port_get_rcu(outdev)->br->dev->ifindex));
+ nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
+ htonl(br_port_get_rcu(outdev)->br->dev->ifindex)))
+ goto nla_put_failure;
} else {
/* Case 2: indev is a bridge group, we need to look
* for physical device (when called from ipv4) */
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_OUTDEV,
- htonl(outdev->ifindex));
- if (skb->nf_bridge && skb->nf_bridge->physoutdev)
- NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
- htonl(skb->nf_bridge->physoutdev->ifindex));
+ if (nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV,
+ htonl(outdev->ifindex)))
+ goto nla_put_failure;
+ if (skb->nf_bridge && skb->nf_bridge->physoutdev &&
+ nla_put_be32(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
+ htonl(skb->nf_bridge->physoutdev->ifindex)))
+ goto nla_put_failure;
}
#endif
}
- if (skb->mark)
- NLA_PUT_BE32(inst->skb, NFULA_MARK, htonl(skb->mark));
+ if (skb->mark &&
+ nla_put_be32(inst->skb, NFULA_MARK, htonl(skb->mark)))
+ goto nla_put_failure;
if (indev && skb->dev &&
skb->mac_header != skb->network_header) {
@@ -459,16 +470,18 @@ __build_packet_message(struct nfulnl_instance *inst,
int len = dev_parse_header(skb, phw.hw_addr);
if (len > 0) {
phw.hw_addrlen = htons(len);
- NLA_PUT(inst->skb, NFULA_HWADDR, sizeof(phw), &phw);
+ if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
+ goto nla_put_failure;
}
}
if (indev && skb_mac_header_was_set(skb)) {
- NLA_PUT_BE16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type));
- NLA_PUT_BE16(inst->skb, NFULA_HWLEN,
- htons(skb->dev->hard_header_len));
- NLA_PUT(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
- skb_mac_header(skb));
+ if (nla_put_be32(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
+ nla_put_be16(inst->skb, NFULA_HWLEN,
+ htons(skb->dev->hard_header_len)) ||
+ nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
+ skb_mac_header(skb)))
+ goto nla_put_failure;
}
if (skb->tstamp.tv64) {
@@ -477,7 +490,8 @@ __build_packet_message(struct nfulnl_instance *inst,
ts.sec = cpu_to_be64(tv.tv_sec);
ts.usec = cpu_to_be64(tv.tv_usec);
- NLA_PUT(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts);
+ if (nla_put(inst->skb, NFULA_TIMESTAMP, sizeof(ts), &ts))
+ goto nla_put_failure;
}
/* UID */
@@ -487,22 +501,24 @@ __build_packet_message(struct nfulnl_instance *inst,
struct file *file = skb->sk->sk_socket->file;
__be32 uid = htonl(file->f_cred->fsuid);
__be32 gid = htonl(file->f_cred->fsgid);
- /* need to unlock here since NLA_PUT may goto */
read_unlock_bh(&skb->sk->sk_callback_lock);
- NLA_PUT_BE32(inst->skb, NFULA_UID, uid);
- NLA_PUT_BE32(inst->skb, NFULA_GID, gid);
+ if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
+ nla_put_be32(inst->skb, NFULA_GID, gid))
+ goto nla_put_failure;
} else
read_unlock_bh(&skb->sk->sk_callback_lock);
}
/* local sequence number */
- if (inst->flags & NFULNL_CFG_F_SEQ)
- NLA_PUT_BE32(inst->skb, NFULA_SEQ, htonl(inst->seq++));
+ if ((inst->flags & NFULNL_CFG_F_SEQ) &&
+ nla_put_be32(inst->skb, NFULA_SEQ, htonl(inst->seq++)))
+ goto nla_put_failure;
/* global sequence number */
- if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
- NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
- htonl(atomic_inc_return(&global_seq)));
+ if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) &&
+ nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL,
+ htonl(atomic_inc_return(&global_seq))))
+ goto nla_put_failure;
if (data_len) {
struct nlattr *nla;
--
1.7.7.6
next prev parent reply other threads:[~2012-04-02 2:59 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-02 2:57 [PATCH 00/51] Get rid of NLA_PUT*() David S. Miller
2012-04-02 2:57 ` [PATCH 01/51] xfrm_user: Stop using NLA_PUT*() David S. Miller
2012-04-02 2:57 ` [PATCH 02/51] wireless: " David S. Miller
2012-04-02 2:57 ` [PATCH 03/51] pkt_sched: " David S. Miller
2012-04-02 2:57 ` [PATCH 04/51] phonet: " David S. Miller
2012-04-02 2:57 ` [PATCH 05/51] netlink: Add nla_put_be{16,32,64}() helpers David S. Miller
2012-04-02 2:57 ` [PATCH 06/51] openvswitch: Stop using NLA_PUT*() David S. Miller
2012-04-02 2:57 ` [PATCH 07/51] nfc: " David S. Miller
2012-04-02 2:57 ` [PATCH 08/51] genetlink: " David S. Miller
2012-04-02 2:57 ` [PATCH 09/51] nfnetlink_queue: " David S. Miller
2012-04-02 2:58 ` David S. Miller [this message]
2012-04-02 2:58 ` [PATCH 11/51] nfnetlink_cttimeout: " David S. Miller
2012-04-02 2:58 ` [PATCH 12/51] nfnetlink_acct: " David S. Miller
2012-04-02 2:58 ` [PATCH 13/51] nf_conntrack_proto_udp{,lite}: " David S. Miller
2012-04-02 2:58 ` [PATCH 14/51] nf_conntrack_proto_tcp: " David S. Miller
2012-04-02 2:58 ` [PATCH 15/51] nf_conntrack_proto_sctp: " David S. Miller
2012-04-02 2:58 ` [PATCH 16/51] nf_conntrack_proto_gre: " David S. Miller
2012-04-02 2:58 ` [PATCH 17/51] nf_conntrack_proto_generic: " David S. Miller
2012-04-02 2:58 ` [PATCH 18/51] nf_conntrack_proto_dccp: " David S. Miller
2012-04-02 2:58 ` [PATCH 19/51] nf_conntrack_netlink: " David S. Miller
2012-04-02 2:58 ` [PATCH 20/51] nf_conntrack_core: " David S. Miller
2012-04-02 2:58 ` [PATCH 21/51] ipvs: " David S. Miller
2012-04-02 5:01 ` Simon Horman
2012-04-02 5:03 ` David Miller
2012-04-02 6:22 ` Simon Horman
2012-04-02 2:58 ` [PATCH 22/51] netlink: Add nla_put_net{16,32,64}() helpers David S. Miller
2012-04-02 2:58 ` [PATCH 23/51] ipset: Stop using NLA_PUT*() David S. Miller
2012-04-02 2:58 ` [PATCH 24/51] l2tp: " David S. Miller
2012-04-02 2:58 ` [PATCH 25/51] dcbnl: " David S. Miller
2012-04-02 2:58 ` [PATCH 26/51] neighbour: " David S. Miller
2012-04-02 2:58 ` [PATCH 27/51] rtnetlink: " David S. Miller
2012-04-02 2:58 ` [PATCH 28/51] netlink: Add nla_put_le{16,32,64}() helpers David S. Miller
2012-04-02 2:58 ` [PATCH 29/51] decnet: Stop using NLA_PUT*() David S. Miller
2012-04-02 2:58 ` [PATCH 30/51] crypto: " David S. Miller
2012-04-02 2:58 ` [PATCH 31/51] infiniband: " David S. Miller
2012-04-02 2:58 ` [PATCH 32/51] can: " David S. Miller
2012-04-02 2:58 ` [PATCH 33/51] enic: " David S. Miller
2012-04-02 2:58 ` [PATCH 34/51] macvlan: " David S. Miller
2012-04-02 2:58 ` [PATCH 35/51] team: " David S. Miller
2012-04-02 2:58 ` [PATCH 36/51] ipv6: " David S. Miller
2012-04-02 2:58 ` [PATCH 37/51] netfilter: " David S. Miller
2012-04-02 2:58 ` [PATCH 38/51] ipv4: " David S. Miller
2012-04-02 2:58 ` [PATCH 39/51] netfilter: " David S. Miller
2012-04-02 2:58 ` [PATCH 40/51] ieee802154: " David S. Miller
2012-04-02 2:58 ` [PATCH 41/51] fib_rules: " David S. Miller
2012-04-02 2:58 ` [PATCH 42/51] gen_stats: " David S. Miller
2012-04-02 2:58 ` [PATCH 43/51] caif: " David S. Miller
2012-04-02 2:58 ` [PATCH 44/51] bridge: " David S. Miller
2012-04-02 2:58 ` [PATCH 45/51] vlan: " David S. Miller
2012-04-02 2:58 ` [PATCH 46/51] ath6kl: " David S. Miller
2012-04-02 2:58 ` [PATCH 47/51] iwlwifi: " David S. Miller
2012-04-02 2:58 ` [PATCH 48/51] mac80211_hwsim: " David S. Miller
2012-04-02 2:58 ` [PATCH 49/51] wl12xx: " David S. Miller
2012-04-02 2:58 ` [PATCH 50/51] xfrm: " David S. Miller
2012-04-02 2:58 ` [PATCH 51/51] netlink: Delete all NLA_PUT*() macros David S. Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1333335521-1348-11-git-send-email-davem@davemloft.net \
--to=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).