From patchwork Thu Oct 19 07:32:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xin Long X-Patchwork-Id: 827957 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="AnAhJopW"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3yHgcw4DgBz9tX7 for ; Thu, 19 Oct 2017 18:32:48 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751920AbdJSHcp (ORCPT ); Thu, 19 Oct 2017 03:32:45 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:46388 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751724AbdJSHcn (ORCPT ); Thu, 19 Oct 2017 03:32:43 -0400 Received: by mail-pf0-f196.google.com with SMTP id p87so5911257pfj.3 for ; Thu, 19 Oct 2017 00:32:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=6YSNqXr0pkaOypwyMgJsV3v4RdEQkRmsHwPZVZmRFnc=; b=AnAhJopWNytnOiGLVyVH7xA5CeFjyMsOZXHiy/shKAZm3kLzdMBWRsE/ajTMCVnSe/ FwEHDvzxD1XxKo67sXUMu1bRY6l8YdhLf/iJrQu3lMxj6mXGjg+Ch4jdwZolrdeqIm2h d0KC4j/Tpje8AYS9Zvv3fbAx9Xab1qKQiaIanR/50x3zMgsnwkdTC/xjBSK2+MIYI/79 XVM0MuF6KPNNYl0SjJex6F7ImOygR75g6VFFeDrdAeFFV1MLHtFyKvSjM3eorapi1f5T bpGFB1uqOt23jT7TsTs6R2Qar4waw7Q6DinhpQnZ2EHCrsrBnIExF+3NtqOLXMbSvNKV /GTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=6YSNqXr0pkaOypwyMgJsV3v4RdEQkRmsHwPZVZmRFnc=; b=DyoRUPAB6tVGiGdD8MRxJhs5ShK6HH2BqAhLAMuHEaDiafLkWyz00QF4u2qUSQzEPG uJXMdWcLn5pmrCs8HCdR6S7h5q5+tijODqUwJffmFEIxrKONarlW2/LvLttSOem+Xs2F p9/MM/0npHImy2cTOK7nlmZHMNAbH+5fBMSLgGoM0hVCb1GDVd9yNkzWRtJ5tguk38g0 8iAOYGY0R31zFLkb9ooBlfjyCkpa8K0LtSj1OFZH2JNMKYrXe8X0TxMOr6X23oZFHKSo qEjkDH19Ix5K28Vyc2AJpSkk4T+QUKGlOxo7nVS4YgITawEfoYFQCJceL7iYV0wowbE9 wxKw== X-Gm-Message-State: AMCzsaXIqp7tK6QKz6N8J1W0SE5qN0R7Ujp92IIXN2JeXusX5sjWBKkO K1eu7qQvxCrb/Cg4/2To9CoBHDgS X-Google-Smtp-Source: ABhQp+RZSPy0liF03a4jUEAYpurZfukNo3tRgB0aNwObV8vc/FqsEDUwK5b0KdTZDkxuwWILQB7Z5A== X-Received: by 10.98.103.206 with SMTP id t75mr669649pfj.173.1508398362356; Thu, 19 Oct 2017 00:32:42 -0700 (PDT) Received: from localhost ([209.132.188.80]) by smtp.gmail.com with ESMTPSA id q13sm28387428pfi.166.2017.10.19.00.32.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 19 Oct 2017 00:32:41 -0700 (PDT) From: Xin Long To: network dev Cc: davem@davemloft.net, Eric Dumazet , Marcelo Ricardo Leitner , Sabrina Dubroca Subject: [PATCH net 1/2] sock_diag: request _diag module only when the family has been registered Date: Thu, 19 Oct 2017 15:32:24 +0800 Message-Id: X-Mailer: git-send-email 2.1.0 In-Reply-To: References: In-Reply-To: References: Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Now when using 'ss' in iproute, kernel would try to load all _diag modules. It causes the corresponding family or proto modules to be loaded as well. Like after 'ss -a', sctp, dccp, af_packet(if it works as a moudle) will be loaded. As these family or proto modules are loaded unexpectly, this might have some security implications. This patch is to introduce sock_diag_request_module() in sock_diag where we only request _diag module when it's corresponding family has been registered. The fix for inet_diag will be done in later patch. Note that we can't just load _diag module without the family or proto loaded, as some symbols in _diag module are from the family or proto moudle. Fixes: 8ef874bfc729 ("sock_diag: Move the sock_ code to net/core/") Reported-by: Sabrina Dubroca Signed-off-by: Xin Long --- include/linux/net.h | 1 + net/core/sock_diag.c | 21 +++++++++++++-------- net/socket.c | 5 +++++ 3 files changed, 19 insertions(+), 8 deletions(-) diff --git a/include/linux/net.h b/include/linux/net.h index d97d80d..6c7cf09 100644 --- a/include/linux/net.h +++ b/include/linux/net.h @@ -225,6 +225,7 @@ enum { int sock_wake_async(struct socket_wq *sk_wq, int how, int band); int sock_register(const struct net_proto_family *fam); void sock_unregister(int family); +bool sock_is_registered(int family); int __sock_create(struct net *net, int family, int type, int proto, struct socket **res, int kern); int sock_create(int family, int type, int proto, struct socket **res); diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c index 217f4e3..643a446 100644 --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -207,6 +207,15 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld) } EXPORT_SYMBOL_GPL(sock_diag_unregister); +static int sock_diag_request_module(int family) +{ + if (!sock_is_registered(family)) + return -ENOENT; + + return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, + NETLINK_SOCK_DIAG, family); +} + static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh) { int err; @@ -220,8 +229,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh) return -EINVAL; if (sock_diag_handlers[req->sdiag_family] == NULL) - request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, - NETLINK_SOCK_DIAG, req->sdiag_family); + sock_diag_request_module(req->sdiag_family); mutex_lock(&sock_diag_table_mutex); hndl = sock_diag_handlers[req->sdiag_family]; @@ -247,8 +255,7 @@ static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, case TCPDIAG_GETSOCK: case DCCPDIAG_GETSOCK: if (inet_rcv_compat == NULL) - request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, - NETLINK_SOCK_DIAG, AF_INET); + sock_diag_request_module(AF_INET); mutex_lock(&sock_diag_table_mutex); if (inet_rcv_compat != NULL) @@ -281,14 +288,12 @@ static int sock_diag_bind(struct net *net, int group) case SKNLGRP_INET_TCP_DESTROY: case SKNLGRP_INET_UDP_DESTROY: if (!sock_diag_handlers[AF_INET]) - request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, - NETLINK_SOCK_DIAG, AF_INET); + sock_diag_request_module(AF_INET); break; case SKNLGRP_INET6_TCP_DESTROY: case SKNLGRP_INET6_UDP_DESTROY: if (!sock_diag_handlers[AF_INET6]) - request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, - NETLINK_SOCK_DIAG, AF_INET); + sock_diag_request_module(AF_INET); break; } return 0; diff --git a/net/socket.c b/net/socket.c index c729625..733d657 100644 --- a/net/socket.c +++ b/net/socket.c @@ -2590,6 +2590,11 @@ void sock_unregister(int family) } EXPORT_SYMBOL(sock_unregister); +bool sock_is_registered(int family) +{ + return family < NPROTO && rcu_access_pointer(net_families[family]); +} + static int __init sock_init(void) { int err;