On Fri, Feb 22, 2019 at 08:03:28AM -0800, Mark Salyzyn wrote:
From: "Arad, Ronen" ronen.arad@intel.com
Direct this upstream db65a3aaf29ecce2e34271d52e8d2336b97bd9fe sha to stable 3.18. This patch addresses a race condition where a call to
nlk->max_recvmsg_len = max(nlk->max_recvmsg_len, len); nlk->max_recvmsg_len = min_t(size_t, nlk->max_recvmsg_len,
one thread in-between another thread:
skb = netlink_alloc_skb(sk,
and
skb_reserve(skb, skb_tailroom(skb) - nlk->max_recvmsg_len);
in netlink_dump. The result can be a negative value and will cause a kernel panic ad BUG at net/core/skbuff.c because the negative value turns into an extremely large positive value.
Original commit:
netlink_dump() allocates skb based on the calculated min_dump_alloc or a per socket max_recvmsg_len. min_alloc_size is maximum space required for any single netdev attributes as calculated by rtnl_calcit(). max_recvmsg_len tracks the user provided buffer to netlink_recvmsg. It is capped at 16KiB. The intention is to avoid small allocations and to minimize the number of calls required to obtain dump information for all net devices.
netlink_dump packs as many small messages as could fit within an skb that was sized for the largest single netdev information. The actual space available within an skb is larger than what is requested. It could be much larger and up to near 2x with align to next power of 2 approach.
Allowing netlink_dump to use all the space available within the allocated skb increases the buffer size a user has to provide to avoid truncaion (i.e. MSG_TRUNG flag set).
It was observed that with many VLANs configured on at least one netdev, a larger buffer of near 64KiB was necessary to avoid "Message truncated" error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when min_alloc_size was only little over 32KiB.
This patch trims skb to allocated size in order to allow the user to avoid truncation with more reasonable buffer size.
Signed-off-by: Ronen Arad ronen.arad@intel.com Signed-off-by: David S. Miller davem@davemloft.net
(cherry pick commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe) Signed-off-by: Mark Salyzyn salyzyn@android.com Cc: Greg Kroah-Hartman gregkh@linuxfoundation.org Cc: Ronen Arad ronen.arad@intel.com Cc: "David S . Miller" davem@davemloft.net Cc: Dmitry Safonov dima@arista.com Cc: David Ahern dsahern@gmail.com Cc: Kirill Tkhai ktkhai@virtuozzo.com Cc: Andrei Vagin avagin@virtuozzo.com Cc: Li RongQing lirongqing@baidu.com Cc: YU Bo tsu.yubo@gmail.com Cc: Denys Vlasenko dvlasenk@redhat.com Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # 3.18
net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
Now queued up, thanks.
greg k-h