From patchwork Mon Nov 9 12:30:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Kubecek X-Patchwork-Id: 11891443 X-Patchwork-Delegate: mkubecek+ethtool@suse.cz Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BA32C388F7 for ; Mon, 9 Nov 2020 12:30:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D92E42083B for ; Mon, 9 Nov 2020 12:30:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729629AbgKIMaz (ORCPT ); Mon, 9 Nov 2020 07:30:55 -0500 Received: from mx2.suse.de ([195.135.220.15]:41022 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727826AbgKIMaz (ORCPT ); Mon, 9 Nov 2020 07:30:55 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 6E416ABDE; Mon, 9 Nov 2020 12:30:54 +0000 (UTC) Received: by lion.mk-sys.cz (Postfix, from userid 1000) id 39E9560344; Mon, 9 Nov 2020 13:30:54 +0100 (CET) Message-Id: <2f9ce041168369105b3734aa3ff6f08bb5600620.1604924742.git.mkubecek@suse.cz> In-Reply-To: References: From: Michal Kubecek Subject: [PATCH ethtool 1/2] netlink: fix use after free in netlink_run_handler() To: netdev@vger.kernel.org Cc: Ido Schimmel , Ivan Vecera Date: Mon, 9 Nov 2020 13:30:54 +0100 (CET) Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: mkubecek+ethtool@suse.cz Valgrind detected use after free in netlink_run_handler(): some members of struct nl_context are accessed after the netlink context is freed by netlink_done(). Use local variables to store the two flags and check them instead. Fixes: 6c19c0d559c8 ("netlink: use genetlink ops information to decide about fallback") Signed-off-by: Michal Kubecek --- netlink/netlink.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/netlink/netlink.c b/netlink/netlink.c index f655f6ea25b7..aaaabdd3048e 100644 --- a/netlink/netlink.c +++ b/netlink/netlink.c @@ -457,6 +457,7 @@ void netlink_run_handler(struct cmd_context *ctx, nl_func_t nlfunc, bool no_fallback) { bool wildcard = ctx->devname && !strcmp(ctx->devname, WILDCARD_DEVNAME); + bool wildcard_unsupported, ioctl_fallback; struct nl_context *nlctx; const char *reason; int ret; @@ -478,14 +479,17 @@ void netlink_run_handler(struct cmd_context *ctx, nl_func_t nlfunc, nlctx = ctx->nlctx; ret = nlfunc(ctx); + wildcard_unsupported = nlctx->wildcard_unsupported; + ioctl_fallback = nlctx->ioctl_fallback; netlink_done(ctx); - if (no_fallback || ret != -EOPNOTSUPP || !nlctx->ioctl_fallback) { - if (nlctx->wildcard_unsupported) + + if (no_fallback || ret != -EOPNOTSUPP || !ioctl_fallback) { + if (wildcard_unsupported) fprintf(stderr, "%s\n", "subcommand does not support wildcard dump"); exit(ret >= 0 ? ret : 1); } - if (nlctx->wildcard_unsupported) + if (wildcard_unsupported) reason = "subcommand does not support wildcard dump"; else reason = "kernel netlink support for subcommand missing"; From patchwork Mon Nov 9 12:30:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michal Kubecek X-Patchwork-Id: 11891447 X-Patchwork-Delegate: mkubecek+ethtool@suse.cz Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDFF0C388F7 for ; Mon, 9 Nov 2020 12:30:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A0D492083B for ; Mon, 9 Nov 2020 12:30:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729767AbgKIMa7 (ORCPT ); Mon, 9 Nov 2020 07:30:59 -0500 Received: from mx2.suse.de ([195.135.220.15]:41180 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727303AbgKIMa6 (ORCPT ); Mon, 9 Nov 2020 07:30:58 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 73F76ABDE; Mon, 9 Nov 2020 12:30:57 +0000 (UTC) Received: by lion.mk-sys.cz (Postfix, from userid 1000) id 3F19E60344; Mon, 9 Nov 2020 13:30:57 +0100 (CET) Message-Id: <2e9c1ddf2de785c168ad8e8906f3e2fd0f1f95e2.1604924742.git.mkubecek@suse.cz> In-Reply-To: References: From: Michal Kubecek Subject: [PATCH ethtool 2/2] netlink: fix leaked instances of struct nl_socket To: netdev@vger.kernel.org Cc: Ido Schimmel , Ivan Vecera Date: Mon, 9 Nov 2020 13:30:57 +0100 (CET) Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: mkubecek+ethtool@suse.cz Valgrind detected memory leaks caused by missing cleanup of netlink context's ethnl_socket, ethnl2_socket and rtnl_socket. Also, contrary to its description, nlsock_done() does not free struct nl_socket itself. Fix nlsock_done() to free the structure and use it to dispose of sockets pointed to by struct nl_context members. Fixes: 50efb3cdd2bb ("netlink: netlink socket wrapper and helpers") Fixes: 87307c30724d ("netlink: initialize ethtool netlink socket") Fixes: 7f3585b22a4b ("netlink: add handler for permaddr (-P)") Signed-off-by: Michal Kubecek --- netlink/netlink.c | 11 ++++++++--- netlink/nlsock.c | 3 +++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/netlink/netlink.c b/netlink/netlink.c index aaaabdd3048e..ffe06339f099 100644 --- a/netlink/netlink.c +++ b/netlink/netlink.c @@ -435,11 +435,16 @@ out_free: static void netlink_done(struct cmd_context *ctx) { - if (!ctx->nlctx) + struct nl_context *nlctx = ctx->nlctx; + + if (!nlctx) return; - free(ctx->nlctx->ops_info); - free(ctx->nlctx); + nlsock_done(nlctx->ethnl_socket); + nlsock_done(nlctx->ethnl2_socket); + nlsock_done(nlctx->rtnl_socket); + free(nlctx->ops_info); + free(nlctx); ctx->nlctx = NULL; cleanup_all_strings(); } diff --git a/netlink/nlsock.c b/netlink/nlsock.c index ef31d8c33b29..0ec2738d81d2 100644 --- a/netlink/nlsock.c +++ b/netlink/nlsock.c @@ -395,8 +395,11 @@ out_msgbuff: */ void nlsock_done(struct nl_socket *nlsk) { + if (!nlsk) + return; if (nlsk->sk) mnl_socket_close(nlsk->sk); msgbuff_done(&nlsk->msgbuff); memset(nlsk, '\0', sizeof(*nlsk)); + free(nlsk); }