Skip to content

Commit ef19e11

Browse files
0x7f454c46klassert
authored andcommitted
xfrm/compat: Cleanup WARN()s that can be user-triggered
Replace WARN_ONCE() that can be triggered from userspace with pr_warn_once(). Those still give user a hint what's the issue. I've left WARN()s that are not possible to trigger with current code-base and that would mean that the code has issues: - relying on current compat_msg_min[type] <= xfrm_msg_min[type] - expected 4-byte padding size difference between compat_msg_min[type] and xfrm_msg_min[type] - compat_policy[type].len <= xfrma_policy[type].len (for every type) Reported-by: [email protected] Fixes: 5f3eea6 ("xfrm/compat: Attach xfrm dumps to 64=>32 bit translator") Cc: "David S. Miller" <[email protected]> Cc: Eric Dumazet <[email protected]> Cc: Herbert Xu <[email protected]> Cc: Jakub Kicinski <[email protected]> Cc: Steffen Klassert <[email protected]> Cc: [email protected] Cc: [email protected] Signed-off-by: Dmitry Safonov <[email protected]> Signed-off-by: Steffen Klassert <[email protected]>
1 parent c7dbf4c commit ef19e11

File tree

1 file changed

+9
-3
lines changed

1 file changed

+9
-3
lines changed

net/xfrm/xfrm_compat.c

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ static struct nlmsghdr *xfrm_nlmsg_put_compat(struct sk_buff *skb,
216216
case XFRM_MSG_GETSADINFO:
217217
case XFRM_MSG_GETSPDINFO:
218218
default:
219-
WARN_ONCE(1, "unsupported nlmsg_type %d", nlh_src->nlmsg_type);
219+
pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
220220
return ERR_PTR(-EOPNOTSUPP);
221221
}
222222

@@ -277,7 +277,7 @@ static int xfrm_xlate64_attr(struct sk_buff *dst, const struct nlattr *src)
277277
return xfrm_nla_cpy(dst, src, nla_len(src));
278278
default:
279279
BUILD_BUG_ON(XFRMA_MAX != XFRMA_IF_ID);
280-
WARN_ONCE(1, "unsupported nla_type %d", src->nla_type);
280+
pr_warn_once("unsupported nla_type %d\n", src->nla_type);
281281
return -EOPNOTSUPP;
282282
}
283283
}
@@ -315,8 +315,10 @@ static int xfrm_alloc_compat(struct sk_buff *skb, const struct nlmsghdr *nlh_src
315315
struct sk_buff *new = NULL;
316316
int err;
317317

318-
if (WARN_ON_ONCE(type >= ARRAY_SIZE(xfrm_msg_min)))
318+
if (type >= ARRAY_SIZE(xfrm_msg_min)) {
319+
pr_warn_once("unsupported nlmsg_type %d\n", nlh_src->nlmsg_type);
319320
return -EOPNOTSUPP;
321+
}
320322

321323
if (skb_shinfo(skb)->frag_list == NULL) {
322324
new = alloc_skb(skb->len + skb_tailroom(skb), GFP_ATOMIC);
@@ -378,6 +380,10 @@ static int xfrm_attr_cpy32(void *dst, size_t *pos, const struct nlattr *src,
378380
struct nlmsghdr *nlmsg = dst;
379381
struct nlattr *nla;
380382

383+
/* xfrm_user_rcv_msg_compat() relies on fact that 32-bit messages
384+
* have the same len or shorted than 64-bit ones.
385+
* 32-bit translation that is bigger than 64-bit original is unexpected.
386+
*/
381387
if (WARN_ON_ONCE(copy_len > payload))
382388
copy_len = payload;
383389

0 commit comments

Comments
 (0)