Commit a70ea994 authored by Alexey Kuznetsov's avatar Alexey Kuznetsov Committed by David S. Miller

[NETLINK]: Fix a severe bug

netlink overrun was broken while improvement of netlink.
Destination socket is used in the place where it was meant to be source socket,
so that now overrun is never sent to user netlink sockets, when it should be,
and it even can be set on kernel socket, which results in complete deadlock
of rtnetlink.

Suggested fix is to restore status quo passing source socket as additional
argument to netlink_attachskb().

A little explanation: overrun is set on a socket, when it failed
to receive some message and sender of this messages does not or even
have no way to handle this error. This happens in two cases:
1. when kernel sends something. Kernel never retransmits and cannot
   wait for buffer space.
2. when user sends a broadcast and the message was not delivered
   to some recipients.
Signed-off-by: default avatarAlexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ad91e6fa
...@@ -160,7 +160,8 @@ extern int netlink_unregister_notifier(struct notifier_block *nb); ...@@ -160,7 +160,8 @@ extern int netlink_unregister_notifier(struct notifier_block *nb);
/* finegrained unicast helpers: */ /* finegrained unicast helpers: */
struct sock *netlink_getsockbyfilp(struct file *filp); struct sock *netlink_getsockbyfilp(struct file *filp);
int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock, long timeo); int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
long timeo, struct sock *ssk);
void netlink_detachskb(struct sock *sk, struct sk_buff *skb); void netlink_detachskb(struct sock *sk, struct sk_buff *skb);
int netlink_sendskb(struct sock *sk, struct sk_buff *skb, int protocol); int netlink_sendskb(struct sock *sk, struct sk_buff *skb, int protocol);
......
...@@ -1018,7 +1018,8 @@ asmlinkage long sys_mq_notify(mqd_t mqdes, ...@@ -1018,7 +1018,8 @@ asmlinkage long sys_mq_notify(mqd_t mqdes,
goto out; goto out;
} }
ret = netlink_attachskb(sock, nc, 0, MAX_SCHEDULE_TIMEOUT); ret = netlink_attachskb(sock, nc, 0,
MAX_SCHEDULE_TIMEOUT, NULL);
if (ret == 1) if (ret == 1)
goto retry; goto retry;
if (ret) { if (ret) {
......
...@@ -702,7 +702,8 @@ struct sock *netlink_getsockbyfilp(struct file *filp) ...@@ -702,7 +702,8 @@ struct sock *netlink_getsockbyfilp(struct file *filp)
* 0: continue * 0: continue
* 1: repeat lookup - reference dropped while waiting for socket memory. * 1: repeat lookup - reference dropped while waiting for socket memory.
*/ */
int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock, long timeo) int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
long timeo, struct sock *ssk)
{ {
struct netlink_sock *nlk; struct netlink_sock *nlk;
...@@ -712,7 +713,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock, long t ...@@ -712,7 +713,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock, long t
test_bit(0, &nlk->state)) { test_bit(0, &nlk->state)) {
DECLARE_WAITQUEUE(wait, current); DECLARE_WAITQUEUE(wait, current);
if (!timeo) { if (!timeo) {
if (!nlk->pid) if (!ssk || nlk_sk(ssk)->pid == 0)
netlink_overrun(sk); netlink_overrun(sk);
sock_put(sk); sock_put(sk);
kfree_skb(skb); kfree_skb(skb);
...@@ -797,7 +798,7 @@ int netlink_unicast(struct sock *ssk, struct sk_buff *skb, u32 pid, int nonblock ...@@ -797,7 +798,7 @@ int netlink_unicast(struct sock *ssk, struct sk_buff *skb, u32 pid, int nonblock
kfree_skb(skb); kfree_skb(skb);
return PTR_ERR(sk); return PTR_ERR(sk);
} }
err = netlink_attachskb(sk, skb, nonblock, timeo); err = netlink_attachskb(sk, skb, nonblock, timeo, ssk);
if (err == 1) if (err == 1)
goto retry; goto retry;
if (err) if (err)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment