Commit ebfe3c51 authored by Di Zhu's avatar Di Zhu Committed by Jakub Kicinski

rtnetlink: fix data overflow in rtnl_calcit()

"ip addr show" command execute error when we have a physical
network card with a large number of VFs

The return value of if_nlmsg_size() in rtnl_calcit() will exceed
range of u16 data type when any network cards has a larger number of
VFs. rtnl_vfinfo_size() will significant increase needed dump size when
the value of num_vfs is larger.

Eventually we get a wrong value of min_ifinfo_dump_size because of overflow
which decides the memory size needed by netlink dump and netlink_dump()
will return -EMSGSIZE because of not enough memory was allocated.

So fix it by promoting  min_dump_alloc data type to u32 to
avoid whole netlink message size overflow and it's also align
with the data type of struct netlink_callback{}.min_dump_alloc
which is assigned by return value of rtnl_calcit()
Signed-off-by: default avatarDi Zhu <zhudi21@huawei.com>
Link: https://lore.kernel.org/r/20201021020053.1401-1-zhudi21@huawei.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 5403caf2
...@@ -240,7 +240,7 @@ struct netlink_dump_control { ...@@ -240,7 +240,7 @@ struct netlink_dump_control {
int (*done)(struct netlink_callback *); int (*done)(struct netlink_callback *);
void *data; void *data;
struct module *module; struct module *module;
u16 min_dump_alloc; u32 min_dump_alloc;
}; };
int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
......
...@@ -3709,13 +3709,13 @@ static int rtnl_dellinkprop(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -3709,13 +3709,13 @@ static int rtnl_dellinkprop(struct sk_buff *skb, struct nlmsghdr *nlh,
return rtnl_linkprop(RTM_DELLINKPROP, skb, nlh, extack); return rtnl_linkprop(RTM_DELLINKPROP, skb, nlh, extack);
} }
static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh) static u32 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
{ {
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
struct net_device *dev; size_t min_ifinfo_dump_size = 0;
struct nlattr *tb[IFLA_MAX+1]; struct nlattr *tb[IFLA_MAX+1];
u32 ext_filter_mask = 0; u32 ext_filter_mask = 0;
u16 min_ifinfo_dump_size = 0; struct net_device *dev;
int hdrlen; int hdrlen;
/* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */ /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */
...@@ -3735,9 +3735,8 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh) ...@@ -3735,9 +3735,8 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
*/ */
rcu_read_lock(); rcu_read_lock();
for_each_netdev_rcu(net, dev) { for_each_netdev_rcu(net, dev) {
min_ifinfo_dump_size = max_t(u16, min_ifinfo_dump_size, min_ifinfo_dump_size = max(min_ifinfo_dump_size,
if_nlmsg_size(dev, if_nlmsg_size(dev, ext_filter_mask));
ext_filter_mask));
} }
rcu_read_unlock(); rcu_read_unlock();
...@@ -5494,7 +5493,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, ...@@ -5494,7 +5493,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) { if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) {
struct sock *rtnl; struct sock *rtnl;
rtnl_dumpit_func dumpit; rtnl_dumpit_func dumpit;
u16 min_dump_alloc = 0; u32 min_dump_alloc = 0;
link = rtnl_get_link(family, type); link = rtnl_get_link(family, type);
if (!link || !link->dumpit) { if (!link || !link->dumpit) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment