[PATCH] netlink: do not proceed if dump's start() errs

[PATCH] netlink: do not proceed if dump's start() errs

[Jason A. Donenfeld]

Drivers that use the start method for netlink dumping rely on dumpit not
being called if start fails. For example, ila_xlat.c allocates memory
and assigns it to cb->args[0] in its start() function. It might fail to
do that and return -ENOMEM instead. However, even when returning an
error, dumpit will be called, which, in the example above, quickly
dereferences the memory in cb->args[0], which will OOPS the kernel. This
is but one example of how this goes wrong.

Since start() has always been a function with an int return type, it
therefore makes sense to use it properly, rather than ignoring it. This
patch thus returns early and does not call dumpit() when start() fails.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: stable@vger.kernel.org
---
 net/netlink/af_netlink.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 327807731b44..be179876227d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2270,8 +2270,11 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
 	mutex_unlock(nlk->cb_mutex);
 
-	if (cb->start)
-		cb->start(cb);
+	if (cb->start) {
+		ret = cb->start(cb);
+		if (ret)
+			return ret;
+	}
 
 	ret = netlink_dump(sk);
 	sock_put(sk);
-- 
2.14.1

Re: [PATCH] netlink: do not proceed if dump's start() errs

[Jason A. Donenfeld]

On Wed, Sep 27, 2017 at 2:39 PM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> -       if (cb->start)
> -               cb->start(cb);
> +       if (cb->start) {
> +               ret = cb->start(cb);
> +               if (ret)

I need to sock_put(sk); before returning. I'll fix this for v2, but
will for additional comments in case anybody has some.

> +                       return ret;
> +       }
>
>         ret = netlink_dump(sk);
>         sock_put(sk);

Re: [PATCH] netlink: do not proceed if dump's start() errs

[Johannes Berg]

On Wed, 2017-09-27 at 14:50 +0200, Jason A. Donenfeld wrote:
> On Wed, Sep 27, 2017 at 2:39 PM, Jason A. Donenfeld <Jason@zx2c4.com>
> wrote:
> > -       if (cb->start)
> > -               cb->start(cb);
> > +       if (cb->start) {
> > +               ret = cb->start(cb);
> > +               if (ret)
> 
> I need to sock_put(sk); before returning. I'll fix this for v2, but
> will for additional comments in case anybody has some.

I guess you could change it to

if (cb->start)
	ret = cb->start(cb);
if (!ret)
	ret = netlink_dump(sk);

johannes

Re: [PATCH] netlink: do not proceed if dump's start() errs

[Jason A. Donenfeld]

On Wed, Sep 27, 2017 at 3:05 PM, Johannes Berg
<johannes@sipsolutions.net> wrote:
> I guess you could change it to
>
> if (cb->start)
>         ret = cb->start(cb);
> if (!ret)
>         ret = netlink_dump(sk);

Very clean. I'll do it like that. I'll wait a bit longer before
submitting v2, but beyond that, seems sane to you?

Jason