.. | .. |
---|
44 | 44 | [NLA_S64] = sizeof(s64), |
---|
45 | 45 | }; |
---|
46 | 46 | |
---|
| 47 | +/* |
---|
| 48 | + * Nested policies might refer back to the original |
---|
| 49 | + * policy in some cases, and userspace could try to |
---|
| 50 | + * abuse that and recurse by nesting in the right |
---|
| 51 | + * ways. Limit recursion to avoid this problem. |
---|
| 52 | + */ |
---|
| 53 | +#define MAX_POLICY_RECURSION_DEPTH 10 |
---|
| 54 | + |
---|
| 55 | +static int __nla_validate_parse(const struct nlattr *head, int len, int maxtype, |
---|
| 56 | + const struct nla_policy *policy, |
---|
| 57 | + unsigned int validate, |
---|
| 58 | + struct netlink_ext_ack *extack, |
---|
| 59 | + struct nlattr **tb, unsigned int depth); |
---|
| 60 | + |
---|
47 | 61 | static int validate_nla_bitfield32(const struct nlattr *nla, |
---|
48 | | - u32 *valid_flags_allowed) |
---|
| 62 | + const u32 valid_flags_mask) |
---|
49 | 63 | { |
---|
50 | 64 | const struct nla_bitfield32 *bf = nla_data(nla); |
---|
51 | | - u32 *valid_flags_mask = valid_flags_allowed; |
---|
52 | 65 | |
---|
53 | | - if (!valid_flags_allowed) |
---|
| 66 | + if (!valid_flags_mask) |
---|
54 | 67 | return -EINVAL; |
---|
55 | 68 | |
---|
56 | 69 | /*disallow invalid bit selector */ |
---|
57 | | - if (bf->selector & ~*valid_flags_mask) |
---|
| 70 | + if (bf->selector & ~valid_flags_mask) |
---|
58 | 71 | return -EINVAL; |
---|
59 | 72 | |
---|
60 | 73 | /*disallow invalid bit values */ |
---|
61 | | - if (bf->value & ~*valid_flags_mask) |
---|
| 74 | + if (bf->value & ~valid_flags_mask) |
---|
62 | 75 | return -EINVAL; |
---|
63 | 76 | |
---|
64 | 77 | /*disallow valid bit values that are not selected*/ |
---|
.. | .. |
---|
68 | 81 | return 0; |
---|
69 | 82 | } |
---|
70 | 83 | |
---|
71 | | -static int validate_nla(const struct nlattr *nla, int maxtype, |
---|
72 | | - const struct nla_policy *policy) |
---|
| 84 | +static int nla_validate_array(const struct nlattr *head, int len, int maxtype, |
---|
| 85 | + const struct nla_policy *policy, |
---|
| 86 | + struct netlink_ext_ack *extack, |
---|
| 87 | + unsigned int validate, unsigned int depth) |
---|
73 | 88 | { |
---|
| 89 | + const struct nlattr *entry; |
---|
| 90 | + int rem; |
---|
| 91 | + |
---|
| 92 | + nla_for_each_attr(entry, head, len, rem) { |
---|
| 93 | + int ret; |
---|
| 94 | + |
---|
| 95 | + if (nla_len(entry) == 0) |
---|
| 96 | + continue; |
---|
| 97 | + |
---|
| 98 | + if (nla_len(entry) < NLA_HDRLEN) { |
---|
| 99 | + NL_SET_ERR_MSG_ATTR_POL(extack, entry, policy, |
---|
| 100 | + "Array element too short"); |
---|
| 101 | + return -ERANGE; |
---|
| 102 | + } |
---|
| 103 | + |
---|
| 104 | + ret = __nla_validate_parse(nla_data(entry), nla_len(entry), |
---|
| 105 | + maxtype, policy, validate, extack, |
---|
| 106 | + NULL, depth + 1); |
---|
| 107 | + if (ret < 0) |
---|
| 108 | + return ret; |
---|
| 109 | + } |
---|
| 110 | + |
---|
| 111 | + return 0; |
---|
| 112 | +} |
---|
| 113 | + |
---|
| 114 | +void nla_get_range_unsigned(const struct nla_policy *pt, |
---|
| 115 | + struct netlink_range_validation *range) |
---|
| 116 | +{ |
---|
| 117 | + WARN_ON_ONCE(pt->validation_type != NLA_VALIDATE_RANGE_PTR && |
---|
| 118 | + (pt->min < 0 || pt->max < 0)); |
---|
| 119 | + |
---|
| 120 | + range->min = 0; |
---|
| 121 | + |
---|
| 122 | + switch (pt->type) { |
---|
| 123 | + case NLA_U8: |
---|
| 124 | + range->max = U8_MAX; |
---|
| 125 | + break; |
---|
| 126 | + case NLA_U16: |
---|
| 127 | + case NLA_BINARY: |
---|
| 128 | + range->max = U16_MAX; |
---|
| 129 | + break; |
---|
| 130 | + case NLA_U32: |
---|
| 131 | + range->max = U32_MAX; |
---|
| 132 | + break; |
---|
| 133 | + case NLA_U64: |
---|
| 134 | + case NLA_MSECS: |
---|
| 135 | + range->max = U64_MAX; |
---|
| 136 | + break; |
---|
| 137 | + default: |
---|
| 138 | + WARN_ON_ONCE(1); |
---|
| 139 | + return; |
---|
| 140 | + } |
---|
| 141 | + |
---|
| 142 | + switch (pt->validation_type) { |
---|
| 143 | + case NLA_VALIDATE_RANGE: |
---|
| 144 | + case NLA_VALIDATE_RANGE_WARN_TOO_LONG: |
---|
| 145 | + range->min = pt->min; |
---|
| 146 | + range->max = pt->max; |
---|
| 147 | + break; |
---|
| 148 | + case NLA_VALIDATE_RANGE_PTR: |
---|
| 149 | + *range = *pt->range; |
---|
| 150 | + break; |
---|
| 151 | + case NLA_VALIDATE_MIN: |
---|
| 152 | + range->min = pt->min; |
---|
| 153 | + break; |
---|
| 154 | + case NLA_VALIDATE_MAX: |
---|
| 155 | + range->max = pt->max; |
---|
| 156 | + break; |
---|
| 157 | + default: |
---|
| 158 | + break; |
---|
| 159 | + } |
---|
| 160 | +} |
---|
| 161 | + |
---|
| 162 | +static int nla_validate_range_unsigned(const struct nla_policy *pt, |
---|
| 163 | + const struct nlattr *nla, |
---|
| 164 | + struct netlink_ext_ack *extack, |
---|
| 165 | + unsigned int validate) |
---|
| 166 | +{ |
---|
| 167 | + struct netlink_range_validation range; |
---|
| 168 | + u64 value; |
---|
| 169 | + |
---|
| 170 | + switch (pt->type) { |
---|
| 171 | + case NLA_U8: |
---|
| 172 | + value = nla_get_u8(nla); |
---|
| 173 | + break; |
---|
| 174 | + case NLA_U16: |
---|
| 175 | + value = nla_get_u16(nla); |
---|
| 176 | + break; |
---|
| 177 | + case NLA_U32: |
---|
| 178 | + value = nla_get_u32(nla); |
---|
| 179 | + break; |
---|
| 180 | + case NLA_U64: |
---|
| 181 | + case NLA_MSECS: |
---|
| 182 | + value = nla_get_u64(nla); |
---|
| 183 | + break; |
---|
| 184 | + case NLA_BINARY: |
---|
| 185 | + value = nla_len(nla); |
---|
| 186 | + break; |
---|
| 187 | + default: |
---|
| 188 | + return -EINVAL; |
---|
| 189 | + } |
---|
| 190 | + |
---|
| 191 | + nla_get_range_unsigned(pt, &range); |
---|
| 192 | + |
---|
| 193 | + if (pt->validation_type == NLA_VALIDATE_RANGE_WARN_TOO_LONG && |
---|
| 194 | + pt->type == NLA_BINARY && value > range.max) { |
---|
| 195 | + pr_warn_ratelimited("netlink: '%s': attribute type %d has an invalid length.\n", |
---|
| 196 | + current->comm, pt->type); |
---|
| 197 | + if (validate & NL_VALIDATE_STRICT_ATTRS) { |
---|
| 198 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 199 | + "invalid attribute length"); |
---|
| 200 | + return -EINVAL; |
---|
| 201 | + } |
---|
| 202 | + |
---|
| 203 | + /* this assumes min <= max (don't validate against min) */ |
---|
| 204 | + return 0; |
---|
| 205 | + } |
---|
| 206 | + |
---|
| 207 | + if (value < range.min || value > range.max) { |
---|
| 208 | + bool binary = pt->type == NLA_BINARY; |
---|
| 209 | + |
---|
| 210 | + if (binary) |
---|
| 211 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 212 | + "binary attribute size out of range"); |
---|
| 213 | + else |
---|
| 214 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 215 | + "integer out of range"); |
---|
| 216 | + |
---|
| 217 | + return -ERANGE; |
---|
| 218 | + } |
---|
| 219 | + |
---|
| 220 | + return 0; |
---|
| 221 | +} |
---|
| 222 | + |
---|
| 223 | +void nla_get_range_signed(const struct nla_policy *pt, |
---|
| 224 | + struct netlink_range_validation_signed *range) |
---|
| 225 | +{ |
---|
| 226 | + switch (pt->type) { |
---|
| 227 | + case NLA_S8: |
---|
| 228 | + range->min = S8_MIN; |
---|
| 229 | + range->max = S8_MAX; |
---|
| 230 | + break; |
---|
| 231 | + case NLA_S16: |
---|
| 232 | + range->min = S16_MIN; |
---|
| 233 | + range->max = S16_MAX; |
---|
| 234 | + break; |
---|
| 235 | + case NLA_S32: |
---|
| 236 | + range->min = S32_MIN; |
---|
| 237 | + range->max = S32_MAX; |
---|
| 238 | + break; |
---|
| 239 | + case NLA_S64: |
---|
| 240 | + range->min = S64_MIN; |
---|
| 241 | + range->max = S64_MAX; |
---|
| 242 | + break; |
---|
| 243 | + default: |
---|
| 244 | + WARN_ON_ONCE(1); |
---|
| 245 | + return; |
---|
| 246 | + } |
---|
| 247 | + |
---|
| 248 | + switch (pt->validation_type) { |
---|
| 249 | + case NLA_VALIDATE_RANGE: |
---|
| 250 | + range->min = pt->min; |
---|
| 251 | + range->max = pt->max; |
---|
| 252 | + break; |
---|
| 253 | + case NLA_VALIDATE_RANGE_PTR: |
---|
| 254 | + *range = *pt->range_signed; |
---|
| 255 | + break; |
---|
| 256 | + case NLA_VALIDATE_MIN: |
---|
| 257 | + range->min = pt->min; |
---|
| 258 | + break; |
---|
| 259 | + case NLA_VALIDATE_MAX: |
---|
| 260 | + range->max = pt->max; |
---|
| 261 | + break; |
---|
| 262 | + default: |
---|
| 263 | + break; |
---|
| 264 | + } |
---|
| 265 | +} |
---|
| 266 | + |
---|
| 267 | +static int nla_validate_int_range_signed(const struct nla_policy *pt, |
---|
| 268 | + const struct nlattr *nla, |
---|
| 269 | + struct netlink_ext_ack *extack) |
---|
| 270 | +{ |
---|
| 271 | + struct netlink_range_validation_signed range; |
---|
| 272 | + s64 value; |
---|
| 273 | + |
---|
| 274 | + switch (pt->type) { |
---|
| 275 | + case NLA_S8: |
---|
| 276 | + value = nla_get_s8(nla); |
---|
| 277 | + break; |
---|
| 278 | + case NLA_S16: |
---|
| 279 | + value = nla_get_s16(nla); |
---|
| 280 | + break; |
---|
| 281 | + case NLA_S32: |
---|
| 282 | + value = nla_get_s32(nla); |
---|
| 283 | + break; |
---|
| 284 | + case NLA_S64: |
---|
| 285 | + value = nla_get_s64(nla); |
---|
| 286 | + break; |
---|
| 287 | + default: |
---|
| 288 | + return -EINVAL; |
---|
| 289 | + } |
---|
| 290 | + |
---|
| 291 | + nla_get_range_signed(pt, &range); |
---|
| 292 | + |
---|
| 293 | + if (value < range.min || value > range.max) { |
---|
| 294 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 295 | + "integer out of range"); |
---|
| 296 | + return -ERANGE; |
---|
| 297 | + } |
---|
| 298 | + |
---|
| 299 | + return 0; |
---|
| 300 | +} |
---|
| 301 | + |
---|
| 302 | +static int nla_validate_int_range(const struct nla_policy *pt, |
---|
| 303 | + const struct nlattr *nla, |
---|
| 304 | + struct netlink_ext_ack *extack, |
---|
| 305 | + unsigned int validate) |
---|
| 306 | +{ |
---|
| 307 | + switch (pt->type) { |
---|
| 308 | + case NLA_U8: |
---|
| 309 | + case NLA_U16: |
---|
| 310 | + case NLA_U32: |
---|
| 311 | + case NLA_U64: |
---|
| 312 | + case NLA_MSECS: |
---|
| 313 | + case NLA_BINARY: |
---|
| 314 | + return nla_validate_range_unsigned(pt, nla, extack, validate); |
---|
| 315 | + case NLA_S8: |
---|
| 316 | + case NLA_S16: |
---|
| 317 | + case NLA_S32: |
---|
| 318 | + case NLA_S64: |
---|
| 319 | + return nla_validate_int_range_signed(pt, nla, extack); |
---|
| 320 | + default: |
---|
| 321 | + WARN_ON(1); |
---|
| 322 | + return -EINVAL; |
---|
| 323 | + } |
---|
| 324 | +} |
---|
| 325 | + |
---|
| 326 | +static int nla_validate_mask(const struct nla_policy *pt, |
---|
| 327 | + const struct nlattr *nla, |
---|
| 328 | + struct netlink_ext_ack *extack) |
---|
| 329 | +{ |
---|
| 330 | + u64 value; |
---|
| 331 | + |
---|
| 332 | + switch (pt->type) { |
---|
| 333 | + case NLA_U8: |
---|
| 334 | + value = nla_get_u8(nla); |
---|
| 335 | + break; |
---|
| 336 | + case NLA_U16: |
---|
| 337 | + value = nla_get_u16(nla); |
---|
| 338 | + break; |
---|
| 339 | + case NLA_U32: |
---|
| 340 | + value = nla_get_u32(nla); |
---|
| 341 | + break; |
---|
| 342 | + case NLA_U64: |
---|
| 343 | + value = nla_get_u64(nla); |
---|
| 344 | + break; |
---|
| 345 | + default: |
---|
| 346 | + return -EINVAL; |
---|
| 347 | + } |
---|
| 348 | + |
---|
| 349 | + if (value & ~(u64)pt->mask) { |
---|
| 350 | + NL_SET_ERR_MSG_ATTR(extack, nla, "reserved bit set"); |
---|
| 351 | + return -EINVAL; |
---|
| 352 | + } |
---|
| 353 | + |
---|
| 354 | + return 0; |
---|
| 355 | +} |
---|
| 356 | + |
---|
| 357 | +static int validate_nla(const struct nlattr *nla, int maxtype, |
---|
| 358 | + const struct nla_policy *policy, unsigned int validate, |
---|
| 359 | + struct netlink_ext_ack *extack, unsigned int depth) |
---|
| 360 | +{ |
---|
| 361 | + u16 strict_start_type = policy[0].strict_start_type; |
---|
74 | 362 | const struct nla_policy *pt; |
---|
75 | 363 | int minlen = 0, attrlen = nla_len(nla), type = nla_type(nla); |
---|
| 364 | + int err = -ERANGE; |
---|
| 365 | + |
---|
| 366 | + if (strict_start_type && type >= strict_start_type) |
---|
| 367 | + validate |= NL_VALIDATE_STRICT; |
---|
76 | 368 | |
---|
77 | 369 | if (type <= 0 || type > maxtype) |
---|
78 | 370 | return 0; |
---|
.. | .. |
---|
84 | 376 | if (nla_attr_len[pt->type] && attrlen != nla_attr_len[pt->type]) { |
---|
85 | 377 | pr_warn_ratelimited("netlink: '%s': attribute type %d has an invalid length.\n", |
---|
86 | 378 | current->comm, type); |
---|
| 379 | + if (validate & NL_VALIDATE_STRICT_ATTRS) { |
---|
| 380 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 381 | + "invalid attribute length"); |
---|
| 382 | + return -EINVAL; |
---|
| 383 | + } |
---|
| 384 | + } |
---|
| 385 | + |
---|
| 386 | + if (validate & NL_VALIDATE_NESTED) { |
---|
| 387 | + if ((pt->type == NLA_NESTED || pt->type == NLA_NESTED_ARRAY) && |
---|
| 388 | + !(nla->nla_type & NLA_F_NESTED)) { |
---|
| 389 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 390 | + "NLA_F_NESTED is missing"); |
---|
| 391 | + return -EINVAL; |
---|
| 392 | + } |
---|
| 393 | + if (pt->type != NLA_NESTED && pt->type != NLA_NESTED_ARRAY && |
---|
| 394 | + pt->type != NLA_UNSPEC && (nla->nla_type & NLA_F_NESTED)) { |
---|
| 395 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 396 | + "NLA_F_NESTED not expected"); |
---|
| 397 | + return -EINVAL; |
---|
| 398 | + } |
---|
87 | 399 | } |
---|
88 | 400 | |
---|
89 | 401 | switch (pt->type) { |
---|
| 402 | + case NLA_REJECT: |
---|
| 403 | + if (extack && pt->reject_message) { |
---|
| 404 | + NL_SET_BAD_ATTR(extack, nla); |
---|
| 405 | + extack->_msg = pt->reject_message; |
---|
| 406 | + return -EINVAL; |
---|
| 407 | + } |
---|
| 408 | + err = -EINVAL; |
---|
| 409 | + goto out_err; |
---|
| 410 | + |
---|
90 | 411 | case NLA_FLAG: |
---|
91 | 412 | if (attrlen > 0) |
---|
92 | | - return -ERANGE; |
---|
| 413 | + goto out_err; |
---|
93 | 414 | break; |
---|
94 | 415 | |
---|
95 | 416 | case NLA_BITFIELD32: |
---|
96 | 417 | if (attrlen != sizeof(struct nla_bitfield32)) |
---|
97 | | - return -ERANGE; |
---|
| 418 | + goto out_err; |
---|
98 | 419 | |
---|
99 | | - return validate_nla_bitfield32(nla, pt->validation_data); |
---|
| 420 | + err = validate_nla_bitfield32(nla, pt->bitfield32_valid); |
---|
| 421 | + if (err) |
---|
| 422 | + goto out_err; |
---|
| 423 | + break; |
---|
100 | 424 | |
---|
101 | 425 | case NLA_NUL_STRING: |
---|
102 | 426 | if (pt->len) |
---|
.. | .. |
---|
104 | 428 | else |
---|
105 | 429 | minlen = attrlen; |
---|
106 | 430 | |
---|
107 | | - if (!minlen || memchr(nla_data(nla), '\0', minlen) == NULL) |
---|
108 | | - return -EINVAL; |
---|
| 431 | + if (!minlen || memchr(nla_data(nla), '\0', minlen) == NULL) { |
---|
| 432 | + err = -EINVAL; |
---|
| 433 | + goto out_err; |
---|
| 434 | + } |
---|
109 | 435 | /* fall through */ |
---|
110 | 436 | |
---|
111 | 437 | case NLA_STRING: |
---|
112 | 438 | if (attrlen < 1) |
---|
113 | | - return -ERANGE; |
---|
| 439 | + goto out_err; |
---|
114 | 440 | |
---|
115 | 441 | if (pt->len) { |
---|
116 | 442 | char *buf = nla_data(nla); |
---|
.. | .. |
---|
119 | 445 | attrlen--; |
---|
120 | 446 | |
---|
121 | 447 | if (attrlen > pt->len) |
---|
122 | | - return -ERANGE; |
---|
| 448 | + goto out_err; |
---|
123 | 449 | } |
---|
124 | 450 | break; |
---|
125 | 451 | |
---|
126 | 452 | case NLA_BINARY: |
---|
127 | 453 | if (pt->len && attrlen > pt->len) |
---|
128 | | - return -ERANGE; |
---|
| 454 | + goto out_err; |
---|
129 | 455 | break; |
---|
130 | 456 | |
---|
131 | | - case NLA_NESTED_COMPAT: |
---|
132 | | - if (attrlen < pt->len) |
---|
133 | | - return -ERANGE; |
---|
134 | | - if (attrlen < NLA_ALIGN(pt->len)) |
---|
135 | | - break; |
---|
136 | | - if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN) |
---|
137 | | - return -ERANGE; |
---|
138 | | - nla = nla_data(nla) + NLA_ALIGN(pt->len); |
---|
139 | | - if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN + nla_len(nla)) |
---|
140 | | - return -ERANGE; |
---|
141 | | - break; |
---|
142 | 457 | case NLA_NESTED: |
---|
143 | 458 | /* a nested attributes is allowed to be empty; if its not, |
---|
144 | 459 | * it must have a size of at least NLA_HDRLEN. |
---|
145 | 460 | */ |
---|
146 | 461 | if (attrlen == 0) |
---|
147 | 462 | break; |
---|
| 463 | + if (attrlen < NLA_HDRLEN) |
---|
| 464 | + goto out_err; |
---|
| 465 | + if (pt->nested_policy) { |
---|
| 466 | + err = __nla_validate_parse(nla_data(nla), nla_len(nla), |
---|
| 467 | + pt->len, pt->nested_policy, |
---|
| 468 | + validate, extack, NULL, |
---|
| 469 | + depth + 1); |
---|
| 470 | + if (err < 0) { |
---|
| 471 | + /* |
---|
| 472 | + * return directly to preserve the inner |
---|
| 473 | + * error message/attribute pointer |
---|
| 474 | + */ |
---|
| 475 | + return err; |
---|
| 476 | + } |
---|
| 477 | + } |
---|
| 478 | + break; |
---|
| 479 | + case NLA_NESTED_ARRAY: |
---|
| 480 | + /* a nested array attribute is allowed to be empty; if its not, |
---|
| 481 | + * it must have a size of at least NLA_HDRLEN. |
---|
| 482 | + */ |
---|
| 483 | + if (attrlen == 0) |
---|
| 484 | + break; |
---|
| 485 | + if (attrlen < NLA_HDRLEN) |
---|
| 486 | + goto out_err; |
---|
| 487 | + if (pt->nested_policy) { |
---|
| 488 | + int err; |
---|
| 489 | + |
---|
| 490 | + err = nla_validate_array(nla_data(nla), nla_len(nla), |
---|
| 491 | + pt->len, pt->nested_policy, |
---|
| 492 | + extack, validate, depth); |
---|
| 493 | + if (err < 0) { |
---|
| 494 | + /* |
---|
| 495 | + * return directly to preserve the inner |
---|
| 496 | + * error message/attribute pointer |
---|
| 497 | + */ |
---|
| 498 | + return err; |
---|
| 499 | + } |
---|
| 500 | + } |
---|
| 501 | + break; |
---|
| 502 | + |
---|
| 503 | + case NLA_UNSPEC: |
---|
| 504 | + if (validate & NL_VALIDATE_UNSPEC) { |
---|
| 505 | + NL_SET_ERR_MSG_ATTR(extack, nla, |
---|
| 506 | + "Unsupported attribute"); |
---|
| 507 | + return -EINVAL; |
---|
| 508 | + } |
---|
| 509 | + if (attrlen < pt->len) |
---|
| 510 | + goto out_err; |
---|
| 511 | + break; |
---|
| 512 | + |
---|
148 | 513 | default: |
---|
149 | 514 | if (pt->len) |
---|
150 | 515 | minlen = pt->len; |
---|
151 | | - else if (pt->type != NLA_UNSPEC) |
---|
| 516 | + else |
---|
152 | 517 | minlen = nla_attr_minlen[pt->type]; |
---|
153 | 518 | |
---|
154 | 519 | if (attrlen < minlen) |
---|
155 | | - return -ERANGE; |
---|
| 520 | + goto out_err; |
---|
| 521 | + } |
---|
| 522 | + |
---|
| 523 | + /* further validation */ |
---|
| 524 | + switch (pt->validation_type) { |
---|
| 525 | + case NLA_VALIDATE_NONE: |
---|
| 526 | + /* nothing to do */ |
---|
| 527 | + break; |
---|
| 528 | + case NLA_VALIDATE_RANGE_PTR: |
---|
| 529 | + case NLA_VALIDATE_RANGE: |
---|
| 530 | + case NLA_VALIDATE_RANGE_WARN_TOO_LONG: |
---|
| 531 | + case NLA_VALIDATE_MIN: |
---|
| 532 | + case NLA_VALIDATE_MAX: |
---|
| 533 | + err = nla_validate_int_range(pt, nla, extack, validate); |
---|
| 534 | + if (err) |
---|
| 535 | + return err; |
---|
| 536 | + break; |
---|
| 537 | + case NLA_VALIDATE_MASK: |
---|
| 538 | + err = nla_validate_mask(pt, nla, extack); |
---|
| 539 | + if (err) |
---|
| 540 | + return err; |
---|
| 541 | + break; |
---|
| 542 | + case NLA_VALIDATE_FUNCTION: |
---|
| 543 | + if (pt->validate) { |
---|
| 544 | + err = pt->validate(nla, extack); |
---|
| 545 | + if (err) |
---|
| 546 | + return err; |
---|
| 547 | + } |
---|
| 548 | + break; |
---|
| 549 | + } |
---|
| 550 | + |
---|
| 551 | + return 0; |
---|
| 552 | +out_err: |
---|
| 553 | + NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt, |
---|
| 554 | + "Attribute failed policy validation"); |
---|
| 555 | + return err; |
---|
| 556 | +} |
---|
| 557 | + |
---|
| 558 | +static int __nla_validate_parse(const struct nlattr *head, int len, int maxtype, |
---|
| 559 | + const struct nla_policy *policy, |
---|
| 560 | + unsigned int validate, |
---|
| 561 | + struct netlink_ext_ack *extack, |
---|
| 562 | + struct nlattr **tb, unsigned int depth) |
---|
| 563 | +{ |
---|
| 564 | + const struct nlattr *nla; |
---|
| 565 | + int rem; |
---|
| 566 | + |
---|
| 567 | + if (depth >= MAX_POLICY_RECURSION_DEPTH) { |
---|
| 568 | + NL_SET_ERR_MSG(extack, |
---|
| 569 | + "allowed policy recursion depth exceeded"); |
---|
| 570 | + return -EINVAL; |
---|
| 571 | + } |
---|
| 572 | + |
---|
| 573 | + if (tb) |
---|
| 574 | + memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1)); |
---|
| 575 | + |
---|
| 576 | + nla_for_each_attr(nla, head, len, rem) { |
---|
| 577 | + u16 type = nla_type(nla); |
---|
| 578 | + |
---|
| 579 | + if (type == 0 || type > maxtype) { |
---|
| 580 | + if (validate & NL_VALIDATE_MAXTYPE) { |
---|
| 581 | + NL_SET_ERR_MSG_ATTR(extack, nla, |
---|
| 582 | + "Unknown attribute type"); |
---|
| 583 | + return -EINVAL; |
---|
| 584 | + } |
---|
| 585 | + continue; |
---|
| 586 | + } |
---|
| 587 | + if (policy) { |
---|
| 588 | + int err = validate_nla(nla, maxtype, policy, |
---|
| 589 | + validate, extack, depth); |
---|
| 590 | + |
---|
| 591 | + if (err < 0) |
---|
| 592 | + return err; |
---|
| 593 | + } |
---|
| 594 | + |
---|
| 595 | + if (tb) |
---|
| 596 | + tb[type] = (struct nlattr *)nla; |
---|
| 597 | + } |
---|
| 598 | + |
---|
| 599 | + if (unlikely(rem > 0)) { |
---|
| 600 | + pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n", |
---|
| 601 | + rem, current->comm); |
---|
| 602 | + NL_SET_ERR_MSG(extack, "bytes leftover after parsing attributes"); |
---|
| 603 | + if (validate & NL_VALIDATE_TRAILING) |
---|
| 604 | + return -EINVAL; |
---|
156 | 605 | } |
---|
157 | 606 | |
---|
158 | 607 | return 0; |
---|
159 | 608 | } |
---|
160 | 609 | |
---|
161 | 610 | /** |
---|
162 | | - * nla_validate - Validate a stream of attributes |
---|
| 611 | + * __nla_validate - Validate a stream of attributes |
---|
163 | 612 | * @head: head of attribute stream |
---|
164 | 613 | * @len: length of attribute stream |
---|
165 | 614 | * @maxtype: maximum attribute type to be expected |
---|
166 | 615 | * @policy: validation policy |
---|
| 616 | + * @validate: validation strictness |
---|
167 | 617 | * @extack: extended ACK report struct |
---|
168 | 618 | * |
---|
169 | 619 | * Validates all attributes in the specified attribute stream against the |
---|
170 | | - * specified policy. Attributes with a type exceeding maxtype will be |
---|
171 | | - * ignored. See documenation of struct nla_policy for more details. |
---|
| 620 | + * specified policy. Validation depends on the validate flags passed, see |
---|
| 621 | + * &enum netlink_validation for more details on that. |
---|
| 622 | + * See documenation of struct nla_policy for more details. |
---|
172 | 623 | * |
---|
173 | 624 | * Returns 0 on success or a negative error code. |
---|
174 | 625 | */ |
---|
175 | | -int nla_validate(const struct nlattr *head, int len, int maxtype, |
---|
176 | | - const struct nla_policy *policy, |
---|
177 | | - struct netlink_ext_ack *extack) |
---|
| 626 | +int __nla_validate(const struct nlattr *head, int len, int maxtype, |
---|
| 627 | + const struct nla_policy *policy, unsigned int validate, |
---|
| 628 | + struct netlink_ext_ack *extack) |
---|
178 | 629 | { |
---|
179 | | - const struct nlattr *nla; |
---|
180 | | - int rem; |
---|
181 | | - |
---|
182 | | - nla_for_each_attr(nla, head, len, rem) { |
---|
183 | | - int err = validate_nla(nla, maxtype, policy); |
---|
184 | | - |
---|
185 | | - if (err < 0) { |
---|
186 | | - if (extack) |
---|
187 | | - extack->bad_attr = nla; |
---|
188 | | - return err; |
---|
189 | | - } |
---|
190 | | - } |
---|
191 | | - |
---|
192 | | - return 0; |
---|
| 630 | + return __nla_validate_parse(head, len, maxtype, policy, validate, |
---|
| 631 | + extack, NULL, 0); |
---|
193 | 632 | } |
---|
194 | | -EXPORT_SYMBOL(nla_validate); |
---|
| 633 | +EXPORT_SYMBOL(__nla_validate); |
---|
195 | 634 | |
---|
196 | 635 | /** |
---|
197 | 636 | * nla_policy_len - Determin the max. length of a policy |
---|
.. | .. |
---|
223 | 662 | EXPORT_SYMBOL(nla_policy_len); |
---|
224 | 663 | |
---|
225 | 664 | /** |
---|
226 | | - * nla_parse - Parse a stream of attributes into a tb buffer |
---|
| 665 | + * __nla_parse - Parse a stream of attributes into a tb buffer |
---|
227 | 666 | * @tb: destination array with maxtype+1 elements |
---|
228 | 667 | * @maxtype: maximum attribute type to be expected |
---|
229 | 668 | * @head: head of attribute stream |
---|
230 | 669 | * @len: length of attribute stream |
---|
231 | 670 | * @policy: validation policy |
---|
| 671 | + * @validate: validation strictness |
---|
| 672 | + * @extack: extended ACK pointer |
---|
232 | 673 | * |
---|
233 | 674 | * Parses a stream of attributes and stores a pointer to each attribute in |
---|
234 | | - * the tb array accessible via the attribute type. Attributes with a type |
---|
235 | | - * exceeding maxtype will be silently ignored for backwards compatibility |
---|
236 | | - * reasons. policy may be set to NULL if no validation is required. |
---|
| 675 | + * the tb array accessible via the attribute type. |
---|
| 676 | + * Validation is controlled by the @validate parameter. |
---|
237 | 677 | * |
---|
238 | 678 | * Returns 0 on success or a negative error code. |
---|
239 | 679 | */ |
---|
240 | | -int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head, |
---|
241 | | - int len, const struct nla_policy *policy, |
---|
242 | | - struct netlink_ext_ack *extack) |
---|
| 680 | +int __nla_parse(struct nlattr **tb, int maxtype, |
---|
| 681 | + const struct nlattr *head, int len, |
---|
| 682 | + const struct nla_policy *policy, unsigned int validate, |
---|
| 683 | + struct netlink_ext_ack *extack) |
---|
243 | 684 | { |
---|
244 | | - const struct nlattr *nla; |
---|
245 | | - int rem, err; |
---|
246 | | - |
---|
247 | | - memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1)); |
---|
248 | | - |
---|
249 | | - nla_for_each_attr(nla, head, len, rem) { |
---|
250 | | - u16 type = nla_type(nla); |
---|
251 | | - |
---|
252 | | - if (type > 0 && type <= maxtype) { |
---|
253 | | - if (policy) { |
---|
254 | | - err = validate_nla(nla, maxtype, policy); |
---|
255 | | - if (err < 0) { |
---|
256 | | - NL_SET_ERR_MSG_ATTR(extack, nla, |
---|
257 | | - "Attribute failed policy validation"); |
---|
258 | | - goto errout; |
---|
259 | | - } |
---|
260 | | - } |
---|
261 | | - |
---|
262 | | - tb[type] = (struct nlattr *)nla; |
---|
263 | | - } |
---|
264 | | - } |
---|
265 | | - |
---|
266 | | - if (unlikely(rem > 0)) |
---|
267 | | - pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n", |
---|
268 | | - rem, current->comm); |
---|
269 | | - |
---|
270 | | - err = 0; |
---|
271 | | -errout: |
---|
272 | | - return err; |
---|
| 685 | + return __nla_validate_parse(head, len, maxtype, policy, validate, |
---|
| 686 | + extack, tb, 0); |
---|
273 | 687 | } |
---|
274 | | -EXPORT_SYMBOL(nla_parse); |
---|
| 688 | +EXPORT_SYMBOL(__nla_parse); |
---|
275 | 689 | |
---|
276 | 690 | /** |
---|
277 | 691 | * nla_find - Find a specific attribute in a stream of attributes |
---|
.. | .. |
---|
457 | 871 | struct nlattr *__nla_reserve_64bit(struct sk_buff *skb, int attrtype, |
---|
458 | 872 | int attrlen, int padattr) |
---|
459 | 873 | { |
---|
460 | | - if (nla_need_padding_for_64bit(skb)) |
---|
461 | | - nla_align_64bit(skb, padattr); |
---|
| 874 | + nla_align_64bit(skb, padattr); |
---|
462 | 875 | |
---|
463 | 876 | return __nla_reserve(skb, attrtype, attrlen); |
---|
464 | 877 | } |
---|