Commit ab5b526d authored by Jiri Pirko's avatar Jiri Pirko Committed by Jakub Kicinski

net: genetlink: always allocate separate attrs for dumpit ops

Individual dumpit ops (start, dumpit, done) are locked by genl_lock
if !family->parallel_ops. However, multiple
genl_family_rcv_msg_dumpit() calls may in in flight in parallel.
Each has a separate struct genl_dumpit_info allocated
but they share the same family->attrbuf. Fix this by allocating separate
memory for attrs for dumpit ops, for non-parallel_ops (for parallel_ops
it is done already).

Reported-by: syzbot+495688b736534bb6c6ad@syzkaller.appspotmail.com
Reported-by: syzbot+ff59dc711f2cff879a05@syzkaller.appspotmail.com
Reported-by: syzbot+dbe02e13bcce52bcf182@syzkaller.appspotmail.com
Reported-by: syzbot+9cb7edb2906ea1e83006@syzkaller.appspotmail.com
Fixes: bf813b0a ("net: genetlink: parse attrs and store in contect info struct during dumpit")
Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
parent 48423dd7
...@@ -474,7 +474,8 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family, ...@@ -474,7 +474,8 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
struct netlink_ext_ack *extack, struct netlink_ext_ack *extack,
const struct genl_ops *ops, const struct genl_ops *ops,
int hdrlen, int hdrlen,
enum genl_validate_flags no_strict_flag) enum genl_validate_flags no_strict_flag,
bool parallel)
{ {
enum netlink_validation validate = ops->validate & no_strict_flag ? enum netlink_validation validate = ops->validate & no_strict_flag ?
NL_VALIDATE_LIBERAL : NL_VALIDATE_LIBERAL :
...@@ -482,7 +483,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family, ...@@ -482,7 +483,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
struct nlattr **attrbuf; struct nlattr **attrbuf;
int err; int err;
if (family->maxattr && family->parallel_ops) { if (parallel) {
attrbuf = kmalloc_array(family->maxattr + 1, attrbuf = kmalloc_array(family->maxattr + 1,
sizeof(struct nlattr *), GFP_KERNEL); sizeof(struct nlattr *), GFP_KERNEL);
if (!attrbuf) if (!attrbuf)
...@@ -493,7 +494,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family, ...@@ -493,7 +494,7 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
err = __nlmsg_parse(nlh, hdrlen, attrbuf, family->maxattr, err = __nlmsg_parse(nlh, hdrlen, attrbuf, family->maxattr,
family->policy, validate, extack); family->policy, validate, extack);
if (err && family->maxattr && family->parallel_ops) { if (err && parallel) {
kfree(attrbuf); kfree(attrbuf);
return ERR_PTR(err); return ERR_PTR(err);
} }
...@@ -501,9 +502,10 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family, ...@@ -501,9 +502,10 @@ genl_family_rcv_msg_attrs_parse(const struct genl_family *family,
} }
static void genl_family_rcv_msg_attrs_free(const struct genl_family *family, static void genl_family_rcv_msg_attrs_free(const struct genl_family *family,
struct nlattr **attrbuf) struct nlattr **attrbuf,
bool parallel)
{ {
if (family->maxattr && family->parallel_ops) if (parallel)
kfree(attrbuf); kfree(attrbuf);
} }
...@@ -542,7 +544,7 @@ static int genl_lock_done(struct netlink_callback *cb) ...@@ -542,7 +544,7 @@ static int genl_lock_done(struct netlink_callback *cb)
rc = ops->done(cb); rc = ops->done(cb);
genl_unlock(); genl_unlock();
} }
genl_family_rcv_msg_attrs_free(info->family, info->attrs); genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
genl_dumpit_info_free(info); genl_dumpit_info_free(info);
return rc; return rc;
} }
...@@ -555,7 +557,7 @@ static int genl_parallel_done(struct netlink_callback *cb) ...@@ -555,7 +557,7 @@ static int genl_parallel_done(struct netlink_callback *cb)
if (ops->done) if (ops->done)
rc = ops->done(cb); rc = ops->done(cb);
genl_family_rcv_msg_attrs_free(info->family, info->attrs); genl_family_rcv_msg_attrs_free(info->family, info->attrs, true);
genl_dumpit_info_free(info); genl_dumpit_info_free(info);
return rc; return rc;
} }
...@@ -585,7 +587,8 @@ static int genl_family_rcv_msg_dumpit(const struct genl_family *family, ...@@ -585,7 +587,8 @@ static int genl_family_rcv_msg_dumpit(const struct genl_family *family,
attrs = genl_family_rcv_msg_attrs_parse(family, nlh, extack, attrs = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
ops, hdrlen, ops, hdrlen,
GENL_DONT_VALIDATE_DUMP_STRICT); GENL_DONT_VALIDATE_DUMP_STRICT,
true);
if (IS_ERR(attrs)) if (IS_ERR(attrs))
return PTR_ERR(attrs); return PTR_ERR(attrs);
...@@ -593,7 +596,7 @@ static int genl_family_rcv_msg_dumpit(const struct genl_family *family, ...@@ -593,7 +596,7 @@ static int genl_family_rcv_msg_dumpit(const struct genl_family *family,
/* Allocate dumpit info. It is going to be freed by done() callback. */ /* Allocate dumpit info. It is going to be freed by done() callback. */
info = genl_dumpit_info_alloc(); info = genl_dumpit_info_alloc();
if (!info) { if (!info) {
genl_family_rcv_msg_attrs_free(family, attrs); genl_family_rcv_msg_attrs_free(family, attrs, true);
return -ENOMEM; return -ENOMEM;
} }
...@@ -645,7 +648,9 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family, ...@@ -645,7 +648,9 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family,
attrbuf = genl_family_rcv_msg_attrs_parse(family, nlh, extack, attrbuf = genl_family_rcv_msg_attrs_parse(family, nlh, extack,
ops, hdrlen, ops, hdrlen,
GENL_DONT_VALIDATE_STRICT); GENL_DONT_VALIDATE_STRICT,
family->maxattr &&
family->parallel_ops);
if (IS_ERR(attrbuf)) if (IS_ERR(attrbuf))
return PTR_ERR(attrbuf); return PTR_ERR(attrbuf);
...@@ -671,7 +676,8 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family, ...@@ -671,7 +676,8 @@ static int genl_family_rcv_msg_doit(const struct genl_family *family,
family->post_doit(ops, skb, &info); family->post_doit(ops, skb, &info);
out: out:
genl_family_rcv_msg_attrs_free(family, attrbuf); genl_family_rcv_msg_attrs_free(family, attrbuf,
family->maxattr && family->parallel_ops);
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment