LKML Archive on
help / color / mirror / Atom feed
From: Greg Kroah-Hartman <>
Cc: Greg Kroah-Hartman <>,, "Jason A. Donenfeld" <>,
	"David S. Miller" <>
Subject: [PATCH 3.18 07/12] af_netlink: ensure that NLMSG_DONE never fails in dumps
Date: Wed, 22 Nov 2017 11:11:50 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

3.18-stable review patch.  If anyone has any objections, please let me know.


From: "Jason A. Donenfeld" <>

[ Upstream commit 0642840b8bb008528dbdf929cec9f65ac4231ad0 ]

The way people generally use netlink_dump is that they fill in the skb
as much as possible, breaking when nla_put returns an error. Then, they
get called again and start filling out the next skb, and again, and so
forth. The mechanism at work here is the ability for the iterative
dumping function to detect when the skb is filled up and not fill it
past the brim, waiting for a fresh skb for the rest of the data.

However, if the attributes are small and nicely packed, it is possible
that a dump callback function successfully fills in attributes until the
skb is of size 4080 (libmnl's default page-sized receive buffer size).
The dump function completes, satisfied, and then, if it happens to be
that this is actually the last skb, and no further ones are to be sent,
then netlink_dump will add on the NLMSG_DONE part:

  nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);

It is very important that netlink_dump does this, of course. However, in
this example, that call to nlmsg_put_answer will fail, because the
previous filling by the dump function did not leave it enough room. And
how could it possibly have done so? All of the nla_put variety of
functions simply check to see if the skb has enough tailroom,
independent of the context it is in.

In order to keep the important assumptions of all netlink dump users, it
is therefore important to give them an skb that has this end part of the
tail already reserved, so that the call to nlmsg_put_answer does not
fail. Otherwise, library authors are forced to find some bizarre sized
receive buffer that has a large modulo relative to the common sizes of
messages received, which is ugly and buggy.

This patch thus saves the NLMSG_DONE for an additional message, for the
case that things are dangerously close to the brim. This requires
keeping track of the errno from ->dump() across calls.

Signed-off-by: Jason A. Donenfeld <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
 net/netlink/af_netlink.c |   17 +++++++++++------
 net/netlink/af_netlink.h |    1 +
 2 files changed, 12 insertions(+), 6 deletions(-)

--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1927,7 +1927,7 @@ static int netlink_dump(struct sock *sk)
 	struct sk_buff *skb = NULL;
 	struct nlmsghdr *nlh;
 	struct module *module;
-	int len, err = -ENOBUFS;
+	int err = -ENOBUFS;
 	int alloc_size;
@@ -1965,9 +1965,11 @@ static int netlink_dump(struct sock *sk)
 		goto errout_skb;
 	netlink_skb_set_owner_r(skb, sk);
-	len = cb->dump(skb, cb);
+	if (nlk->dump_done_errno > 0)
+		nlk->dump_done_errno = cb->dump(skb, cb);
-	if (len > 0) {
+	if (nlk->dump_done_errno > 0 ||
+	    skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) {
 		if (sk_filter(sk, skb))
@@ -1977,13 +1979,15 @@ static int netlink_dump(struct sock *sk)
 		return 0;
-	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
-	if (!nlh)
+	nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE,
+			       sizeof(nlk->dump_done_errno), NLM_F_MULTI);
+	if (WARN_ON(!nlh))
 		goto errout_skb;
 	nl_dump_check_consistent(cb, nlh);
-	memcpy(nlmsg_data(nlh), &len, sizeof(len));
+	memcpy(nlmsg_data(nlh), &nlk->dump_done_errno,
+	       sizeof(nlk->dump_done_errno));
 	if (sk_filter(sk, skb))
@@ -2048,6 +2052,7 @@ int __netlink_dump_start(struct sock *ss
 	cb->skb = skb;
 	nlk->cb_running = true;
+	nlk->dump_done_errno = INT_MAX;
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -35,6 +35,7 @@ struct netlink_sock {
 	size_t			max_recvmsg_len;
 	wait_queue_head_t	wait;
 	bool			cb_running;
+	int			dump_done_errno;
 	struct netlink_callback	cb;
 	struct mutex		*cb_mutex;
 	struct mutex		cb_def_mutex;

  parent reply	other threads:[~2017-11-22 10:12 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-11-22 10:11 [PATCH 3.18 00/12] 3.18.84-stable review Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 01/12] ipv6/dccp: do not inherit ipv6_mc_list from parent Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 02/12] net/sctp: Always set scope_id in sctp_inet6_skb_msgname Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 03/12] tcp: do not mangle skb->cb[] in tcp_make_synack() Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 04/12] netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 05/12] sctp: do not peel off an assoc from one netns to another one Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 06/12] fealnx: Fix building error on MIPS Greg Kroah-Hartman
2017-11-22 10:11 ` Greg Kroah-Hartman [this message]
2017-11-22 10:11 ` [PATCH 3.18 08/12] vlan: fix a use-after-free in vlan_device_event() Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 09/12] ima: do not update security.ima if appraisal status is not INTEGRITY_PASS Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 10/12] ocfs2: should wait dio before inode lock in ocfs2_setattr() Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 11/12] ipmi: fix unsigned long underflow Greg Kroah-Hartman
2017-11-22 10:11 ` [PATCH 3.18 12/12] coda: fix kernel memory exposure attempt in fsync Greg Kroah-Hartman
     [not found] ` <>
2017-11-22 14:57   ` [PATCH 3.18 00/12] 3.18.84-stable review Greg Kroah-Hartman
     [not found]   ` <>
2017-11-23  7:29     ` Greg Kroah-Hartman
2017-11-22 21:32 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).