The patch titled
netlink: improve string attribute validation
has been added to the -mm tree. Its filename is
netlink-improve-string-attribute-validation.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: netlink: improve string attribute validation
From: Thomas Graf <tgraf@xxxxxxx>
Introduce a new attribute type NLA_NUL_STRING to support NUL terminated
strings. Attributes of this kind require to carry a terminating NUL within
the maximum specified in the policy.
The `old' NLA_STRING which is not required to be NUL terminated is extended
to provide means to specify a maximum length of the string.
Aims at easing the pain with using nla_strlcpy() on temporary buffers.
The old `minlen' field is renamed to `len' for cosmetic purposes which is
ok since nobody was using it at this point.
(akpm: the per-task-delay-accounting patches need this, and should be
reworked to use it once it is available)
Signed-off-by: Thomas Graf <tgraf@xxxxxxx>
Cc: "David S. Miller" <davem@xxxxxxxxxxxxx>
Cc: jamal <hadi@xxxxxxxxxx>
Cc: Balbir Singh <balbir@xxxxxxxxxx>
Cc: Shailabh Nagar <nagar@xxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
include/net/netlink.h | 15 +++++++++++----
net/netlink/attr.c | 40 ++++++++++++++++++++++++++++------------
2 files changed, 39 insertions(+), 16 deletions(-)
diff -puN include/net/netlink.h~netlink-improve-string-attribute-validation include/net/netlink.h
--- a/include/net/netlink.h~netlink-improve-string-attribute-validation
+++ a/include/net/netlink.h
@@ -158,6 +158,7 @@ enum {
NLA_FLAG,
NLA_MSECS,
NLA_NESTED,
+ NLA_NUL_STRING,
__NLA_TYPE_MAX,
};
@@ -166,21 +167,27 @@ enum {
/**
* struct nla_policy - attribute validation policy
* @type: Type of attribute or NLA_UNSPEC
- * @minlen: Minimal length of payload required to be available
+ * @len: Type specific length of payload
*
* Policies are defined as arrays of this struct, the array must be
* accessible by attribute type up to the highest identifier to be expected.
*
+ * Meaning of `len' field:
+ * NLA_STRING Maximum length of string
+ * NLA_NUL_STRING Maximum length of string including NUL
+ * NLA_FLAG Unused
+ * All other Exact length of attribute payload
+ *
* Example:
* static struct nla_policy my_policy[ATTR_MAX+1] __read_mostly = {
* [ATTR_FOO] = { .type = NLA_U16 },
- * [ATTR_BAR] = { .type = NLA_STRING },
- * [ATTR_BAZ] = { .minlen = sizeof(struct mystruct) },
+ * [ATTR_BAR] = { .type = NLA_STRING, len = BARSIZ },
+ * [ATTR_BAZ] = { .len = sizeof(struct mystruct) },
* };
*/
struct nla_policy {
u16 type;
- u16 minlen;
+ u16 len;
};
extern void netlink_run_queue(struct sock *sk, unsigned int *qlen,
diff -puN net/netlink/attr.c~netlink-improve-string-attribute-validation net/netlink/attr.c
--- a/net/netlink/attr.c~netlink-improve-string-attribute-validation
+++ a/net/netlink/attr.c
@@ -20,7 +20,6 @@ static u16 nla_attr_minlen[NLA_TYPE_MAX+
[NLA_U16] = sizeof(u16),
[NLA_U32] = sizeof(u32),
[NLA_U64] = sizeof(u64),
- [NLA_STRING] = 1,
[NLA_NESTED] = NLA_HDRLEN,
};
@@ -28,7 +27,7 @@ static int validate_nla(struct nlattr *n
struct nla_policy *policy)
{
struct nla_policy *pt;
- int minlen = 0;
+ int minlen = 0, attrlen = nla_len(nla);
if (nla->nla_type <= 0 || nla->nla_type > maxtype)
return 0;
@@ -37,16 +36,33 @@ static int validate_nla(struct nlattr *n
BUG_ON(pt->type > NLA_TYPE_MAX);
- if (pt->minlen)
- minlen = pt->minlen;
- else if (pt->type != NLA_UNSPEC)
- minlen = nla_attr_minlen[pt->type];
-
- if (pt->type == NLA_FLAG && nla_len(nla) > 0)
- return -ERANGE;
-
- if (nla_len(nla) < minlen)
- return -ERANGE;
+ switch (pt->type) {
+ case NLA_FLAG:
+ if (attrlen > 0)
+ return -ERANGE;
+ break;
+
+ case NLA_NUL_STRING:
+ minlen = min_t(int, attrlen, pt->len);
+
+ if (!minlen || strnchr(nla_data(nla), minlen, '\0') == NULL)
+ return -EINVAL;
+ /* fall through */
+
+ case NLA_STRING:
+ if (attrlen < 1 || attrlen > pt->len)
+ return -ERANGE;
+ break;
+
+ default:
+ if (pt->len)
+ minlen = pt->len;
+ else if (pt->type != NLA_UNSPEC)
+ minlen = nla_attr_minlen[pt->type];
+
+ if (attrlen < minlen)
+ return -ERANGE;
+ }
return 0;
}
_
Patches currently in -mm which might be from tgraf@xxxxxxx are
netlink-improve-string-attribute-validation.patch
per-task-delay-accounting-taskstats-interface-control-exit-data-through-cpumasks-fix.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
