Commit 2deeb477 authored by Kaike Wan's avatar Kaike Wan Committed by Doug Ledford

IB/sa: Fix netlink local service GFP crash

The rdma netlink local service registers a handler to handle RESOLVE
response and another handler to handle SET_TIMEOUT request. The first
thing these handlers do is to call netlink_capable() to check the
access right of the received skb to make sure that the sender has root
access. Under normal conditions, such responses and requests will be
directly forwarded to the handlers without going through the netlink_dump
pathway (see ibnl_rcv_msg() in drivers/infiniband/core/netlink.c).
However, a user application could send a RESOLVE request (not response)
to the local service, which will fall into the netlink_dump pathway,
where a new skb will be created without initializing the control block.
This new skb will be eventually forwarded to the local service RESOLVE
response handler. Unfortunately, netlink_capable() will cause general
protection fault if the skb's control block is not initialized. This
patch will address the problem by checking the skb first.
Signed-off-by: default avatarKaike Wan <kaike.wan@intel.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent f9a6ed62
...@@ -717,7 +717,9 @@ static int ib_nl_handle_set_timeout(struct sk_buff *skb, ...@@ -717,7 +717,9 @@ static int ib_nl_handle_set_timeout(struct sk_buff *skb,
struct nlattr *tb[LS_NLA_TYPE_MAX]; struct nlattr *tb[LS_NLA_TYPE_MAX];
int ret; int ret;
if (!netlink_capable(skb, CAP_NET_ADMIN)) if (!(nlh->nlmsg_flags & NLM_F_REQUEST) ||
!(NETLINK_CB(skb).sk) ||
!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM; return -EPERM;
ret = nla_parse(tb, LS_NLA_TYPE_MAX - 1, nlmsg_data(nlh), ret = nla_parse(tb, LS_NLA_TYPE_MAX - 1, nlmsg_data(nlh),
...@@ -791,7 +793,9 @@ static int ib_nl_handle_resolve_resp(struct sk_buff *skb, ...@@ -791,7 +793,9 @@ static int ib_nl_handle_resolve_resp(struct sk_buff *skb,
int found = 0; int found = 0;
int ret; int ret;
if (!netlink_capable(skb, CAP_NET_ADMIN)) if ((nlh->nlmsg_flags & NLM_F_REQUEST) ||
!(NETLINK_CB(skb).sk) ||
!netlink_capable(skb, CAP_NET_ADMIN))
return -EPERM; return -EPERM;
spin_lock_irqsave(&ib_nl_request_lock, flags); spin_lock_irqsave(&ib_nl_request_lock, flags);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment