From patchwork Fri Jan 18 18:46:17 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jakub Kicinski X-Patchwork-Id: 1027700 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=netronome.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=netronome-com.20150623.gappssmtp.com header.i=@netronome-com.20150623.gappssmtp.com header.b="mVgQysM7"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43h90W58mRz9sCh for ; Sat, 19 Jan 2019 05:47:07 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729190AbfARSrG (ORCPT ); Fri, 18 Jan 2019 13:47:06 -0500 Received: from mail-qt1-f196.google.com ([209.85.160.196]:41748 "EHLO mail-qt1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728908AbfARSqn (ORCPT ); Fri, 18 Jan 2019 13:46:43 -0500 Received: by mail-qt1-f196.google.com with SMTP id l12so16296808qtf.8 for ; Fri, 18 Jan 2019 10:46:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netronome-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=C/9TNWb7f7NLPeeYjtzreoQlOaiwnQ8Q9xvjhavUaDs=; b=mVgQysM78xoATvZhDRzgnYKd2pMM1pTJt5bkuMWX2GQDBDZSpXiNA0aQex5e1iOn1w 92ok2DHF/3q6vyqPR+KLx768bwZjsZb/KP8PVKVHH/soBWdEOwafXi0yjIG0JAJ9P6Wp CmcljB85345fZM/VJNDovzknm7JiVSHBVRa+cwmFTuwFdHoifNNsYXNwZfi7+Cz0vE/i jz1MCdqSYZp1s90iv0U1/niECY5bcXpJwEGLFDQRApQS3pzZ3xL7aCWqIg6j6FXp+jF8 nCfk/UDXM+Lm1lI1OcMjK9VtUj8opukLmKxsGF0I2EWnelD4bdNKYHW+rf66EcMy8/fH eULg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=C/9TNWb7f7NLPeeYjtzreoQlOaiwnQ8Q9xvjhavUaDs=; b=SCts+CgivNggTIgk77q799tVF+bKl+ML0Ls58w4Js1drJzxalPUy4CfhZw6wkVY+O2 Q0aktD60VtNs3347n8smC0rPRKHMaD3nYkDrRrfQbRzEmUHuLBfPPtjiFQ8FJorEcwap 9U6GORj/OZESP9dRaHLEtVUTWtBIp6jIiERFhv3kUUR2Jwued65fRN8RYVY656lGspZt RsegcB1TRM7kB2oXGBZaCIL/pAnKv5BfilUv58AGXUO2YclYLFRU/rDN7r4A98vWh6wK 3BCfT2pKPU75OfHoopuWwJAy7UeYFcoUA7TvsmpcTREJzCjO3HQSWP8CN/jmRu+3Gf4A 0BnQ== X-Gm-Message-State: AJcUukdWdQaXFT8EN2Lcak69DCssiR5XZ9zPx/L7tsm/fjevdKzgtidS BiPfXWAwo+RJFu4xfZGRB37M9w== X-Google-Smtp-Source: ALg8bN7F7icVERhFivWPJLWll+t8wam1TN44v5HDRfIG5qE/mr5hRpoaPM4M9WtIw4rDAIt/oSTYLQ== X-Received: by 2002:aed:2151:: with SMTP id 75mr17437466qtc.24.1547837201893; Fri, 18 Jan 2019 10:46:41 -0800 (PST) Received: from jkicinski-Precision-T1700.netronome.com ([66.60.152.14]) by smtp.gmail.com with ESMTPSA id l4sm12467794qtf.22.2019.01.18.10.46.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 18 Jan 2019 10:46:41 -0800 (PST) From: Jakub Kicinski To: davem@davemloft.net, dsahern@gmail.com Cc: netdev@vger.kernel.org, oss-drivers@netronome.com, Jakub Kicinski , ktkhai@virtuozzo.com, nicolas.dichtel@6wind.com Subject: [PATCH net-next v2 05/14] net: namespace: perform strict checks also for doit handlers Date: Fri, 18 Jan 2019 10:46:17 -0800 Message-Id: <20190118184626.24021-6-jakub.kicinski@netronome.com> X-Mailer: git-send-email 2.19.2 In-Reply-To: <20190118184626.24021-1-jakub.kicinski@netronome.com> References: <20190118184626.24021-1-jakub.kicinski@netronome.com> MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Make RTM_GETNSID's doit handler use strict checks when NETLINK_F_STRICT_CHK is set. v2: - don't check size >= sizeof(struct rtgenmsg) (Nicolas). Signed-off-by: Jakub Kicinski --- CC: ktkhai@virtuozzo.com CC: nicolas.dichtel@6wind.com --- net/core/net_namespace.c | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c index b02fb19df2cc..17f36317363d 100644 --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -778,6 +778,41 @@ static int rtnl_net_fill(struct sk_buff *skb, struct net_fill_args *args) return -EMSGSIZE; } +static int rtnl_net_valid_getid_req(struct sk_buff *skb, + const struct nlmsghdr *nlh, + struct nlattr **tb, + struct netlink_ext_ack *extack) +{ + int i, err; + + if (!netlink_strict_get_check(skb)) + return nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX, + rtnl_net_policy, extack); + + err = nlmsg_parse_strict(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX, + rtnl_net_policy, extack); + if (err) + return err; + + for (i = 0; i <= NETNSA_MAX; i++) { + if (!tb[i]) + continue; + + switch (i) { + case NETNSA_PID: + case NETNSA_FD: + case NETNSA_NSID: + case NETNSA_TARGET_NSID: + break; + default: + NL_SET_ERR_MSG(extack, "Unsupported attribute in peer netns getid request"); + return -EINVAL; + } + } + + return 0; +} + static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, struct netlink_ext_ack *extack) { @@ -793,8 +828,7 @@ static int rtnl_net_getid(struct sk_buff *skb, struct nlmsghdr *nlh, struct sk_buff *msg; int err; - err = nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, NETNSA_MAX, - rtnl_net_policy, extack); + err = rtnl_net_valid_getid_req(skb, nlh, tb, extack); if (err < 0) return err; if (tb[NETNSA_PID]) {