redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

netlink: fix wrong subscription bitmask to group mapping in

Browse source 
The subscription bitmask passed via struct sockaddr_nl is converted to
the group number when calling the netlink_bind() and netlink_unbind()
callbacks.

The conversion is however incorrect since bitmask (1 << 0) needs to be
mapped to group number 1. Note that you cannot specify the group number 0
(usually known as _NONE) from setsockopt() using NETLINK_ADD_MEMBERSHIP
since this is rejected through -EINVAL.

This problem became noticeable since 97840cb ("netfilter: nfnetlink:
fix insufficient validation in nfnetlink_bind") when binding to bitmask
(1 << 0) in ctnetlink.

Reported-by: Andre Tomt <andre@tomt.net>
Reported-by: Ivan Delalande <colona@arista.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Pablo Neira 2015-01-29 10:51:53 +01:00 committed by David S. Miller
parent 3cdaa5be9e
commit 8b7c36d810
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
net/netlink/af_netlink.c
View file

@ -1438,7 +1438,7 @@ static void netlink_undo_bind(int group, long unsigned int groups,
for (undo = 0; undo < group; undo++) for (undo = 0; undo < group; undo++)
if (test_bit(undo, &groups)) if (test_bit(undo, &groups))
nlk->netlink_unbind(sock_net(sk), undo); nlk->netlink_unbind(sock_net(sk), undo + 1);
} }
static int netlink_bind(struct socket *sock, struct sockaddr *addr, static int netlink_bind(struct socket *sock, struct sockaddr *addr,
@ -1476,7 +1476,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
for (group = 0; group < nlk->ngroups; group++) { for (group = 0; group < nlk->ngroups; group++) {
if (!test_bit(group, &groups)) if (!test_bit(group, &groups))
continue; continue;
err = nlk->netlink_bind(net, group); err = nlk->netlink_bind(net, group + 1);
if (!err) if (!err)
continue; continue;
netlink_undo_bind(group, groups, sk); netlink_undo_bind(group, groups, sk);