[net-2.6 PATCH 1/2] netlink: bug fix: don't overrun skbs on vf_port dump

[net-2.6 PATCH 1/2] netlink: bug fix: don't overrun skbs on vf_port dump

[Scott Feldman]

From: Scott Feldman <scofeldm@cisco.com>

Noticed by Patrick McHardy: was continuing to fill skb after a
nla_put_failure, ignoring the size calculated by upper layer.  Now,
return -EMSGSIZE on any overruns, but also allow netdev to
fail ndo_get_vf_port with error other than -EMSGSIZE, thus unwinding
nest.

Signed-off-by: Scott Feldman <scofeldm@cisco.com>
---
 net/core/rtnetlink.c |   15 +++++++++------
 1 files changed, 9 insertions(+), 6 deletions(-)


diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 7ab86f3..7331bb2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -722,14 +722,13 @@ static int rtnl_vf_ports_fill(struct sk_buff *skb, struct net_device *dev)
 
 	for (vf = 0; vf < dev_num_vf(dev->dev.parent); vf++) {
 		vf_port = nla_nest_start(skb, IFLA_VF_PORT);
-		if (!vf_port) {
-			nla_nest_cancel(skb, vf_ports);
-			return -EMSGSIZE;
-		}
+		if (!vf_port)
+			goto nla_put_failure;
 		NLA_PUT_U32(skb, IFLA_PORT_VF, vf);
 		err = dev->netdev_ops->ndo_get_vf_port(dev, vf, skb);
+		if (err == -EMSGSIZE)
+			goto nla_put_failure;
 		if (err) {
-nla_put_failure:
 			nla_nest_cancel(skb, vf_port);
 			continue;
 		}
@@ -739,6 +738,10 @@ nla_put_failure:
 	nla_nest_end(skb, vf_ports);
 
 	return 0;
+
+nla_put_failure:
+	nla_nest_cancel(skb, vf_ports);
+	return -EMSGSIZE;
 }
 
 static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev)
@@ -753,7 +756,7 @@ static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev)
 	err = dev->netdev_ops->ndo_get_vf_port(dev, PORT_SELF_VF, skb);
 	if (err) {
 		nla_nest_cancel(skb, port_self);
-		return err;
+		return (err == -EMSGSIZE) ? err : 0;
 	}
 
 	nla_nest_end(skb, port_self);

[net-2.6 PATCH 2/2] netlink: bug fix: wrong size was calculated for vfinfo list blob

[Scott Feldman]

From: Scott Feldman <scofeldm@cisco.com>

The wrong size was being calculated for vfinfo.  In one case, it was over-
calculating using nlmsg_total_size on attrs, in another case, it was
under-calculating by assuming ifla_vf_* structs are packed together, but
each struct is it's own attr w/ hdr (and padding).

Signed-off-by: Scott Feldman <scofeldm@cisco.com>
---
 net/core/rtnetlink.c |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)


diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 7331bb2..1a2af24 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -650,11 +650,12 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev)
 	if (dev->dev.parent && dev_is_pci(dev->dev.parent)) {
 
 		int num_vfs = dev_num_vf(dev->dev.parent);
-		size_t size = nlmsg_total_size(sizeof(struct nlattr));
-		size += nlmsg_total_size(num_vfs * sizeof(struct nlattr));
-		size += num_vfs * (sizeof(struct ifla_vf_mac) +
-				  sizeof(struct ifla_vf_vlan) +
-				  sizeof(struct ifla_vf_tx_rate));
+		size_t size = nla_total_size(sizeof(struct nlattr));
+		size += nla_total_size(num_vfs * sizeof(struct nlattr));
+		size += num_vfs *
+			(nla_total_size(sizeof(struct ifla_vf_mac)) +
+			 nla_total_size(sizeof(struct ifla_vf_vlan)) +
+			 nla_total_size(sizeof(struct ifla_vf_tx_rate)));
 		return size;
 	} else
 		return 0;

Re: [net-2.6 PATCH 1/2] netlink: bug fix: don't overrun skbs on vf_port dump

[David Miller]

From: Scott Feldman <scofeldm@cisco.com>
Date: Fri, 28 May 2010 00:15:46 -0700

> From: Scott Feldman <scofeldm@cisco.com>
> 
> Noticed by Patrick McHardy: was continuing to fill skb after a
> nla_put_failure, ignoring the size calculated by upper layer.  Now,
> return -EMSGSIZE on any overruns, but also allow netdev to
> fail ndo_get_vf_port with error other than -EMSGSIZE, thus unwinding
> nest.
> 
> Signed-off-by: Scott Feldman <scofeldm@cisco.com>

Applied.

Re: [net-2.6 PATCH 2/2] netlink: bug fix: wrong size was calculated for vfinfo list blob

[David Miller]

From: Scott Feldman <scofeldm@cisco.com>
Date: Fri, 28 May 2010 00:15:51 -0700

> From: Scott Feldman <scofeldm@cisco.com>
> 
> The wrong size was being calculated for vfinfo.  In one case, it was over-
> calculating using nlmsg_total_size on attrs, in another case, it was
> under-calculating by assuming ifla_vf_* structs are packed together, but
> each struct is it's own attr w/ hdr (and padding).
> 
> Signed-off-by: Scott Feldman <scofeldm@cisco.com>

Applied.