From patchwork Fri Feb 22 16:03:28 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Salyzyn X-Patchwork-Id: 1046988 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=android.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=android.com header.i=@android.com header.b="FpvWNRzh"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 445bkK1fkYz9s1b for ; Sat, 23 Feb 2019 03:04:09 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726912AbfBVQEH (ORCPT ); Fri, 22 Feb 2019 11:04:07 -0500 Received: from mail-pg1-f196.google.com ([209.85.215.196]:33354 "EHLO mail-pg1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726714AbfBVQEH (ORCPT ); Fri, 22 Feb 2019 11:04:07 -0500 Received: by mail-pg1-f196.google.com with SMTP id h11so1340511pgl.0 for ; Fri, 22 Feb 2019 08:04:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=android.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=4C8EM7PAuUt6hpnlstAb/V1eFsLaP3MGjMb2gR8iaBQ=; b=FpvWNRzhKa5GnV8aiDCFJN+5lEchggfDt/QwMKRr1XVCUKWRHUdaCLF6lHbL3/nOKD RAAptJT3nwhTW/+n/BdoBeDIoh/P5NoCBQu4LMSHQkqWq8/PUvt/ORA0fs8Geyk/jQmP /QDYez2TBycM6NZ4a65ptO6fFop3NLReo4k/VfqK5r6G7tnEtTifM4niDzdNZ79lB2QZ GDIq3oqD9WMZ9DvtpU8Y17jfqTHo91aCAMsiYmpKISc8IlfX9yHBqQ1Xl9bZN2CLE0ea o6+vR5q9SDta3Dam2tKM/H8aqSNGi5rFY54ThlRy8l/VPE9lIA4kKnIaxLPWPgSuTfEH AMew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=4C8EM7PAuUt6hpnlstAb/V1eFsLaP3MGjMb2gR8iaBQ=; b=WTTtjYDh0byUCrOF4NJU4tzgQY+vUhrBOXFD+/irtIPykmDPVjXSGx+68p6DgROTov XL5PDjB82mXldVX3aUhrB9z3kmo2qbJVqxfsTYRjSucqI6eacqzQhk17WQe/UZeIq0hN yz0sYUVn1a8PDLimegQwj7roSPi2vPHHY+uz59629eecAdX/EYgsgrqacamt5t+OKBy+ OF7A496W6lJii/FRelQd6rJoMEt1ljJ4DVBQCXFPVW/7QACKeL+QJZrNm8d66xsEjai0 SETTFXuE6tmOiRt8Q99TIX9UntnyrJpL7gqLM5XX+oC+ZecIJKoraETgIlFlfbomehUy Xq5A== X-Gm-Message-State: AHQUAuYbBAlqeUIKtNz5bjcqLRsMqr1JIO0zoF5v04IqfX2x94ksFPJ+ ZN9nfYtfwOk+5uaueimzDbTSlQ== X-Google-Smtp-Source: AHgI3IbvYCB2qZQOJzjiBNUgaO/Z4utFFYhtWHKptxAYh/yU70Mvd7Ee9QgzfAjuth3dnedSELTsEw== X-Received: by 2002:a63:575d:: with SMTP id h29mr4655710pgm.442.1550851445795; Fri, 22 Feb 2019 08:04:05 -0800 (PST) Received: from nebulus.mtv.corp.google.com ([2620:0:1000:1612:b4fb:6752:f21f:3502]) by smtp.gmail.com with ESMTPSA id h63sm7271822pfd.148.2019.02.22.08.04.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 22 Feb 2019 08:04:05 -0800 (PST) From: Mark Salyzyn To: linux-kernel@vger.kernel.org Cc: "Arad, Ronen" , "David S . Miller" , Mark Salyzyn , Greg Kroah-Hartman , Dmitry Safonov , David Ahern , Kirill Tkhai , Andrei Vagin , Li RongQing , YU Bo , Denys Vlasenko , netdev@vger.kernel.org, stable@vger.kernel.org, Eric Dumazet , Alexander Potapenko Subject: [stable 3.18 backport v2] netlink: Trim skb to alloc size to avoid MSG_TRUNC Date: Fri, 22 Feb 2019 08:03:28 -0800 Message-Id: <20190222160330.34237-1-salyzyn@android.com> X-Mailer: git-send-email 2.21.0.rc0.258.g878e2cd30e-goog MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: "Arad, Ronen" Direct this upstream db65a3aaf29ecce2e34271d52e8d2336b97bd9fe sha to stable 3.18. This patch addresses a race condition where a call to nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len, one thread in-between another thread: skb = netlink_alloc_skb(sk, and skb_reserve(skb, skb_tailroom(skb) - nlk->max_recvmsg_len); in netlink_dump. The result can be a negative value and will cause a kernel panic ad BUG at net/core/skbuff.c because the negative value turns into an extremely large positive value. Original commit: netlink_dump() allocates skb based on the calculated min_dump_alloc or a per socket max_recvmsg_len. min_alloc_size is maximum space required for any single netdev attributes as calculated by rtnl_calcit(). max_recvmsg_len tracks the user provided buffer to netlink_recvmsg. It is capped at 16KiB. The intention is to avoid small allocations and to minimize the number of calls required to obtain dump information for all net devices. netlink_dump packs as many small messages as could fit within an skb that was sized for the largest single netdev information. The actual space available within an skb is larger than what is requested. It could be much larger and up to near 2x with align to next power of 2 approach. Allowing netlink_dump to use all the space available within the allocated skb increases the buffer size a user has to provide to avoid truncaion (i.e. MSG_TRUNG flag set). It was observed that with many VLANs configured on at least one netdev, a larger buffer of near 64KiB was necessary to avoid "Message truncated" error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when min_alloc_size was only little over 32KiB. This patch trims skb to allocated size in order to allow the user to avoid truncation with more reasonable buffer size. Signed-off-by: Ronen Arad Signed-off-by: David S. Miller (cherry pick commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe) Signed-off-by: Mark Salyzyn Cc: Greg Kroah-Hartman Cc: Ronen Arad Cc: "David S . Miller" Cc: Dmitry Safonov Cc: David Ahern Cc: Kirill Tkhai Cc: Andrei Vagin Cc: Li RongQing Cc: YU Bo Cc: Denys Vlasenko Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # 3.18 --- net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 50096e0edd8e..14295cef6b76 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1977,6 +1977,7 @@ static int netlink_dump(struct sock *sk) struct nlmsghdr *nlh; struct module *module; int err = -ENOBUFS; + int alloc_min_size; int alloc_size; mutex_lock(nlk->cb_mutex); @@ -1985,9 +1986,6 @@ static int netlink_dump(struct sock *sk) goto errout_skb; } - cb = &nlk->cb; - alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); - if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) goto errout_skb; @@ -1996,22 +1994,34 @@ static int netlink_dump(struct sock *sk) * to reduce number of system calls on dump operations, if user * ever provided a big enough buffer. */ - if (alloc_size < nlk->max_recvmsg_len) { - skb = netlink_alloc_skb(sk, - nlk->max_recvmsg_len, - nlk->portid, + cb = &nlk->cb; + alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); + + if (alloc_min_size < nlk->max_recvmsg_len) { + alloc_size = nlk->max_recvmsg_len; + skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, (GFP_KERNEL & ~__GFP_WAIT) | __GFP_NOWARN | __GFP_NORETRY); - /* available room should be exact amount to avoid MSG_TRUNC */ - if (skb) - skb_reserve(skb, skb_tailroom(skb) - - nlk->max_recvmsg_len); } - if (!skb) + if (!skb) { + alloc_size = alloc_min_size; skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, (GFP_KERNEL & ~__GFP_WAIT)); + } if (!skb) goto errout_skb; + + /* Trim skb to allocated size. User is expected to provide buffer as + * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at + * netlink_recvmsg())). dump will pack as many smaller messages as + * could fit within the allocated skb. skb is typically allocated + * with larger space than required (could be as much as near 2x the + * requested size with align to next power of 2 approach). Allowing + * dump to use the excess space makes it difficult for a user to have a + * reasonable static buffer based on the expected largest dump of a + * single netdev. The outcome is MSG_TRUNC error. + */ + skb_reserve(skb, skb_tailroom(skb) - alloc_size); netlink_skb_set_owner_r(skb, sk); if (nlk->dump_done_errno > 0)