UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netlink: add validation of NLA_F_NESTED flag 

Add new validation flag NL_VALIDATE_NESTED which adds three consistency
checks of NLA_F_NESTED_FLAG:

  - the flag is set on attributes with NLA_NESTED{,_ARRAY} policy
  - the flag is not set on attributes with other policies except NLA_UNSPEC
  - the flag is set on attribute passed to nla_parse_nested()

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>

v2: change error messages to mention NLA_F_NESTED explicitly
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Michal Kubecek 2019-05-02 16:15:10 +02:00 committed by David S. Miller
parent d54a16b201
commit b424e432e7
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
include/net/netlink.h
View File

@ -401,6 +401,8 @@ struct nl_info {
* are enforced going forward. * are enforced going forward.
* @NL_VALIDATE_STRICT_ATTRS: strict attribute policy parsing (e.g. * @NL_VALIDATE_STRICT_ATTRS: strict attribute policy parsing (e.g.
* U8, U16, U32 must have exact size, etc.) * U8, U16, U32 must have exact size, etc.)
* @NL_VALIDATE_NESTED: Check that NLA_F_NESTED is set for NLA_NESTED(_ARRAY)
* and unset for other policies.
*/ */
enum netlink_validation { enum netlink_validation {
NL_VALIDATE_LIBERAL = 0, NL_VALIDATE_LIBERAL = 0,
@ -408,6 +410,7 @@ enum netlink_validation {
NL_VALIDATE_MAXTYPE = BIT(1), NL_VALIDATE_MAXTYPE = BIT(1),
NL_VALIDATE_UNSPEC = BIT(2), NL_VALIDATE_UNSPEC = BIT(2),
NL_VALIDATE_STRICT_ATTRS = BIT(3), NL_VALIDATE_STRICT_ATTRS = BIT(3),
NL_VALIDATE_NESTED = BIT(4),
}; };
#define NL_VALIDATE_DEPRECATED_STRICT (NL_VALIDATE_TRAILING |\ #define NL_VALIDATE_DEPRECATED_STRICT (NL_VALIDATE_TRAILING |\
@ -415,7 +418,8 @@ enum netlink_validation {
#define NL_VALIDATE_STRICT (NL_VALIDATE_TRAILING |\ #define NL_VALIDATE_STRICT (NL_VALIDATE_TRAILING |\
NL_VALIDATE_MAXTYPE |\ NL_VALIDATE_MAXTYPE |\
NL_VALIDATE_UNSPEC |\ NL_VALIDATE_UNSPEC |\
NL_VALIDATE_STRICT_ATTRS) NL_VALIDATE_STRICT_ATTRS |\
NL_VALIDATE_NESTED)
int netlink_rcv_skb(struct sk_buff *skb, int netlink_rcv_skb(struct sk_buff *skb,
int (*cb)(struct sk_buff *, struct nlmsghdr *, int (*cb)(struct sk_buff *, struct nlmsghdr *,
@ -1132,6 +1136,11 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype,
const struct nla_policy *policy, const struct nla_policy *policy,
struct netlink_ext_ack *extack) struct netlink_ext_ack *extack)
{ {
if (!(nla->nla_type & NLA_F_NESTED)) {
NL_SET_ERR_MSG_ATTR(extack, nla, "NLA_F_NESTED is missing");
return -EINVAL;
}
return __nla_parse(tb, maxtype, nla_data(nla), nla_len(nla), policy, return __nla_parse(tb, maxtype, nla_data(nla), nla_len(nla), policy,
NL_VALIDATE_STRICT, extack); NL_VALIDATE_STRICT, extack);
} }

15
lib/nlattr.c
View File

@ -184,6 +184,21 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
} }
} }
if (validate & NL_VALIDATE_NESTED) {
if ((pt->type == NLA_NESTED || pt->type == NLA_NESTED_ARRAY) &&
!(nla->nla_type & NLA_F_NESTED)) {
NL_SET_ERR_MSG_ATTR(extack, nla,
"NLA_F_NESTED is missing");
return -EINVAL;
}
if (pt->type != NLA_NESTED && pt->type != NLA_NESTED_ARRAY &&
pt->type != NLA_UNSPEC && (nla->nla_type & NLA_F_NESTED)) {
NL_SET_ERR_MSG_ATTR(extack, nla,
"NLA_F_NESTED not expected");
return -EINVAL;
}
}
switch (pt->type) { switch (pt->type) {
case NLA_EXACT_LEN: case NLA_EXACT_LEN:
if (attrlen != pt->len) if (attrlen != pt->len)