You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
250 lines
9.4 KiB
250 lines
9.4 KiB
commit 2eecc8afd02d8c65cf098cbae4de87f332dc21bd |
|
Author: Florian Weimer <fweimer@redhat.com> |
|
Date: Mon Nov 9 12:48:41 2015 +0100 |
|
|
|
Terminate process on invalid netlink response from kernel [BZ #12926] |
|
|
|
The recvmsg system calls for netlink sockets have been particularly |
|
prone to picking up unrelated data after a file descriptor race |
|
(where the descriptor is closed and reopened concurrently in a |
|
multi-threaded process, as the result of a file descriptor |
|
management issue elsewhere). This commit adds additional error |
|
checking and aborts the process if a datagram of unexpected length |
|
(without the netlink header) is received, or an error code which |
|
cannot happen due to the way the netlink socket is used. |
|
|
|
[BZ #12926] |
|
Terminate process on invalid netlink response. |
|
* sysdeps/unix/sysv/linux/netlinkaccess.h |
|
(__netlink_assert_response): Declare. |
|
* sysdeps/unix/sysv/linux/netlink_assert_response.c: New file. |
|
* sysdeps/unix/sysv/linux/Makefile [$(subdir) == inet] |
|
(sysdep_routines): Add netlink_assert_response. |
|
* sysdeps/unix/sysv/linux/check_native.c (__check_native): Call |
|
__netlink_assert_response. |
|
* sysdeps/unix/sysv/linux/check_pf.c (make_request): Likewise. |
|
* sysdeps/unix/sysv/linux/ifaddrs.c (__netlink_request): Likewise. |
|
* sysdeps/unix/sysv/linux/Versions (GLIBC_PRIVATE): Add |
|
__netlink_assert_response. |
|
|
|
Conflicts: |
|
sysdeps/unix/sysv/linux/check_pf.c |
|
Upstream commit fda389c8f0311dd5786be91a7b54b9f935fcafa1 |
|
("Fix infinite loop in check_pf (BZ #12926)") was not backported |
|
before and is superseded by the upstream commit backported here. |
|
sysdeps/unix/sysv/linux/netlinkaccess.h |
|
Missing backport of e054f494306530720114b321b3d97ca2f397cbbb |
|
("Add #include <stdint.h> for uint[32|64]_t usage (except |
|
installed headers)"). |
|
|
|
diff --git a/sysdeps/unix/sysv/linux/Makefile b/sysdeps/unix/sysv/linux/Makefile |
|
index 95cff0ef651e74a9..bb69b985e6df7fb1 100644 |
|
--- a/sysdeps/unix/sysv/linux/Makefile |
|
+++ b/sysdeps/unix/sysv/linux/Makefile |
|
@@ -114,6 +114,7 @@ sysdep_headers += netinet/if_fddi.h netinet/if_tr.h \ |
|
netipx/ipx.h netash/ash.h netax25/ax25.h netatalk/at.h \ |
|
netrom/netrom.h netpacket/packet.h netrose/rose.h \ |
|
neteconet/ec.h netiucv/iucv.h |
|
+sysdep_routines += netlink_assert_response |
|
endif |
|
|
|
# Don't compile the ctype glue code, since there is no old non-GNU C library. |
|
diff --git a/sysdeps/unix/sysv/linux/Versions b/sysdeps/unix/sysv/linux/Versions |
|
index 16bb28159099c5fa..202ffccc2908ddcc 100644 |
|
--- a/sysdeps/unix/sysv/linux/Versions |
|
+++ b/sysdeps/unix/sysv/linux/Versions |
|
@@ -169,5 +169,7 @@ libc { |
|
GLIBC_PRIVATE { |
|
# functions used in other libraries |
|
__syscall_rt_sigqueueinfo; |
|
+ # functions used by nscd |
|
+ __netlink_assert_response; |
|
} |
|
} |
|
diff --git a/sysdeps/unix/sysv/linux/check_native.c b/sysdeps/unix/sysv/linux/check_native.c |
|
index 4968a07a0f8c7932..319b46762aeaf3b6 100644 |
|
--- a/sysdeps/unix/sysv/linux/check_native.c |
|
+++ b/sysdeps/unix/sysv/linux/check_native.c |
|
@@ -35,6 +35,7 @@ |
|
|
|
#include <not-cancel.h> |
|
|
|
+#include "netlinkaccess.h" |
|
|
|
void |
|
__check_native (uint32_t a1_index, int *a1_native, |
|
@@ -117,6 +118,7 @@ __check_native (uint32_t a1_index, int *a1_native, |
|
}; |
|
|
|
ssize_t read_len = TEMP_FAILURE_RETRY (__recvmsg (fd, &msg, 0)); |
|
+ __netlink_assert_response (fd, read_len); |
|
if (read_len < 0) |
|
goto out_fail; |
|
|
|
diff --git a/sysdeps/unix/sysv/linux/check_pf.c b/sysdeps/unix/sysv/linux/check_pf.c |
|
index d33e1b497d8ba9c7..6b28a735a14f1498 100644 |
|
--- a/sysdeps/unix/sysv/linux/check_pf.c |
|
+++ b/sysdeps/unix/sysv/linux/check_pf.c |
|
@@ -36,6 +36,7 @@ |
|
#include <atomic.h> |
|
#include <nscd/nscd-client.h> |
|
|
|
+#include "netlinkaccess.h" |
|
|
|
#ifndef IFA_F_HOMEADDRESS |
|
# define IFA_F_HOMEADDRESS 0 |
|
@@ -178,6 +179,7 @@ make_request (int fd, pid_t pid) |
|
}; |
|
|
|
ssize_t read_len = TEMP_FAILURE_RETRY (__recvmsg (fd, &msg, 0)); |
|
+ __netlink_assert_response (fd, read_len); |
|
if (read_len < 0) |
|
goto out_fail; |
|
|
|
diff --git a/sysdeps/unix/sysv/linux/ifaddrs.c b/sysdeps/unix/sysv/linux/ifaddrs.c |
|
index 179653103e057b79..c87e594e30a314fe 100644 |
|
--- a/sysdeps/unix/sysv/linux/ifaddrs.c |
|
+++ b/sysdeps/unix/sysv/linux/ifaddrs.c |
|
@@ -169,6 +169,7 @@ __netlink_request (struct netlink_handle *h, int type) |
|
}; |
|
|
|
read_len = TEMP_FAILURE_RETRY (__recvmsg (h->fd, &msg, 0)); |
|
+ __netlink_assert_response (h->fd, read_len); |
|
if (read_len < 0) |
|
goto out_fail; |
|
|
|
diff --git a/sysdeps/unix/sysv/linux/netlink_assert_response.c b/sysdeps/unix/sysv/linux/netlink_assert_response.c |
|
new file mode 100644 |
|
index 0000000000000000..b570e93db840fec1 |
|
--- /dev/null |
|
+++ b/sysdeps/unix/sysv/linux/netlink_assert_response.c |
|
@@ -0,0 +1,106 @@ |
|
+/* Check recvmsg results for netlink sockets. |
|
+ Copyright (C) 2015 Free Software Foundation, Inc. |
|
+ This file is part of the GNU C Library. |
|
+ |
|
+ The GNU C Library is free software; you can redistribute it and/or |
|
+ modify it under the terms of the GNU Lesser General Public |
|
+ License as published by the Free Software Foundation; either |
|
+ version 2.1 of the License, or (at your option) any later version. |
|
+ |
|
+ The GNU C Library is distributed in the hope that it will be useful, |
|
+ but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
|
+ Lesser General Public License for more details. |
|
+ |
|
+ You should have received a copy of the GNU Lesser General Public |
|
+ License along with the GNU C Library; if not, see |
|
+ <http://www.gnu.org/licenses/>. */ |
|
+ |
|
+#include <errno.h> |
|
+#include <fcntl.h> |
|
+#include <stdio.h> |
|
+#include <sys/socket.h> |
|
+ |
|
+#include "netlinkaccess.h" |
|
+ |
|
+static int |
|
+get_address_family (int fd) |
|
+{ |
|
+ struct sockaddr_storage sa; |
|
+ socklen_t sa_len = sizeof (sa); |
|
+ if (__getsockname (fd, (struct sockaddr *) &sa, &sa_len) < 0) |
|
+ return -1; |
|
+ /* Check that the socket family number is preserved despite in-band |
|
+ signaling. */ |
|
+ _Static_assert (sizeof (sa.ss_family) < sizeof (int), "address family size"); |
|
+ _Static_assert (0 < (__typeof__ (sa.ss_family)) -1, |
|
+ "address family unsigned"); |
|
+ return sa.ss_family; |
|
+} |
|
+ |
|
+void |
|
+internal_function |
|
+__netlink_assert_response (int fd, ssize_t result) |
|
+{ |
|
+ if (result < 0) |
|
+ { |
|
+ /* Check if the error is unexpected. */ |
|
+ bool terminate = false; |
|
+ int error_code = errno; |
|
+ int family = get_address_family (fd); |
|
+ if (family != AF_NETLINK) |
|
+ /* If the address family does not match (or getsockname |
|
+ failed), report the original error. */ |
|
+ terminate = true; |
|
+ else if (error_code == EBADF |
|
+ || error_code == ENOTCONN |
|
+ || error_code == ENOTSOCK |
|
+ || error_code == ECONNREFUSED) |
|
+ /* These errors indicate that the descriptor is not a |
|
+ connected socket. */ |
|
+ terminate = true; |
|
+ else if (error_code == EAGAIN || error_code == EWOULDBLOCK) |
|
+ { |
|
+ /* The kernel might return EAGAIN for other reasons than a |
|
+ non-blocking socket. But if the socket is not blocking, |
|
+ it is not ours, so report the error. */ |
|
+ int mode = __fcntl (fd, F_GETFL, 0); |
|
+ if (mode < 0 || (mode & O_NONBLOCK) != 0) |
|
+ terminate = true; |
|
+ } |
|
+ if (terminate) |
|
+ { |
|
+ char message[200]; |
|
+ if (family < 0) |
|
+ __snprintf (message, sizeof (message), |
|
+ "Unexpected error %d on netlink descriptor %d", |
|
+ error_code, fd); |
|
+ else |
|
+ __snprintf (message, sizeof (message), |
|
+ "Unexpected error %d on netlink descriptor %d" |
|
+ " (address family %d)", |
|
+ error_code, fd, family); |
|
+ __libc_fatal (message); |
|
+ } |
|
+ else |
|
+ /* Restore orignal errno value. */ |
|
+ __set_errno (error_code); |
|
+ } |
|
+ else if (result < sizeof (struct nlmsghdr)) |
|
+ { |
|
+ char message[200]; |
|
+ int family = get_address_family (fd); |
|
+ if (family < 0) |
|
+ __snprintf (message, sizeof (message), |
|
+ "Unexpected netlink response of size %zd" |
|
+ " on descriptor %d", |
|
+ result, fd); |
|
+ else |
|
+ __snprintf (message, sizeof (message), |
|
+ "Unexpected netlink response of size %zd" |
|
+ " on descriptor %d (address family %d)", |
|
+ result, fd, family); |
|
+ __libc_fatal (message); |
|
+ } |
|
+} |
|
+libc_hidden_def (__netlink_assert_response) |
|
diff --git a/sysdeps/unix/sysv/linux/netlinkaccess.h b/sysdeps/unix/sysv/linux/netlinkaccess.h |
|
index 6cd8a882640d2486..33dc4e12cd464681 100644 |
|
--- a/sysdeps/unix/sysv/linux/netlinkaccess.h |
|
+++ b/sysdeps/unix/sysv/linux/netlinkaccess.h |
|
@@ -18,6 +18,7 @@ |
|
#ifndef _NETLINKACCESS_H |
|
#define _NETLINKACCESS_H 1 |
|
|
|
+#include <sys/types.h> |
|
#include <asm/types.h> |
|
#include <linux/netlink.h> |
|
#include <linux/rtnetlink.h> |
|
@@ -49,5 +50,10 @@ extern void __netlink_close (struct netlink_handle *h); |
|
extern void __netlink_free_handle (struct netlink_handle *h); |
|
extern int __netlink_request (struct netlink_handle *h, int type); |
|
|
|
+/* Terminate the process if RESULT is an invalid recvmsg result for |
|
+ the netlink socket FD. */ |
|
+void __netlink_assert_response (int fd, ssize_t result) |
|
+ internal_function; |
|
+libc_hidden_proto (__netlink_assert_response) |
|
|
|
#endif /* netlinkaccess.h */
|
|
|