Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 249556192859490b6280552d4b877064f9f5ee48

Authored by Patrick McHardy
1 parent f9ffc31251
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

netfilter: nf_log: fix direct userspace memory access in proc handler 

Signed-off-by: Patrick McHardy <kaber@trash.net>

Showing 1 changed file with 11 additions and 5 deletions Inline Diff

net/netfilter/nf_log.c
Diff comments   View file @ 2495561
1 #include <linux/kernel.h> 1 #include <linux/kernel.h>
2 #include <linux/init.h> 2 #include <linux/init.h>
3 #include <linux/module.h> 3 #include <linux/module.h>
4 #include <linux/proc_fs.h> 4 #include <linux/proc_fs.h>
5 #include <linux/skbuff.h> 5 #include <linux/skbuff.h>
6 #include <linux/netfilter.h> 6 #include <linux/netfilter.h>
7 #include <linux/seq_file.h> 7 #include <linux/seq_file.h>
8 #include <net/protocol.h> 8 #include <net/protocol.h>
9 #include <net/netfilter/nf_log.h> 9 #include <net/netfilter/nf_log.h>
10 10
11 #include "nf_internals.h" 11 #include "nf_internals.h"
12 12
13 /* Internal logging interface, which relies on the real 13 /* Internal logging interface, which relies on the real
14 LOG target modules */ 14 LOG target modules */
15 15
16 #define NF_LOG_PREFIXLEN 128 16 #define NF_LOG_PREFIXLEN 128
17 #define NFLOGGER_NAME_LEN 64 17 #define NFLOGGER_NAME_LEN 64
18 18
19 static const struct nf_logger *nf_loggers[NFPROTO_NUMPROTO] __read_mostly; 19 static const struct nf_logger *nf_loggers[NFPROTO_NUMPROTO] __read_mostly;
20 static struct list_head nf_loggers_l[NFPROTO_NUMPROTO] __read_mostly; 20 static struct list_head nf_loggers_l[NFPROTO_NUMPROTO] __read_mostly;
21 static DEFINE_MUTEX(nf_log_mutex); 21 static DEFINE_MUTEX(nf_log_mutex);
22 22
23 static struct nf_logger *__find_logger(int pf, const char *str_logger) 23 static struct nf_logger *__find_logger(int pf, const char *str_logger)
24 { 24 {
25 struct nf_logger *t; 25 struct nf_logger *t;
26 26
27 list_for_each_entry(t, &nf_loggers_l[pf], list[pf]) { 27 list_for_each_entry(t, &nf_loggers_l[pf], list[pf]) {
28 if (!strnicmp(str_logger, t->name, strlen(t->name))) 28 if (!strnicmp(str_logger, t->name, strlen(t->name)))
29 return t; 29 return t;
30 } 30 }
31 31
32 return NULL; 32 return NULL;
33 } 33 }
34 34
35 /* return EEXIST if the same logger is registred, 0 on success. */ 35 /* return EEXIST if the same logger is registred, 0 on success. */
36 int nf_log_register(u_int8_t pf, struct nf_logger *logger) 36 int nf_log_register(u_int8_t pf, struct nf_logger *logger)
37 { 37 {
38 const struct nf_logger *llog; 38 const struct nf_logger *llog;
39 int i; 39 int i;
40 40
41 if (pf >= ARRAY_SIZE(nf_loggers)) 41 if (pf >= ARRAY_SIZE(nf_loggers))
42 return -EINVAL; 42 return -EINVAL;
43 43
44 for (i = 0; i < ARRAY_SIZE(logger->list); i++) 44 for (i = 0; i < ARRAY_SIZE(logger->list); i++)
45 INIT_LIST_HEAD(&logger->list[i]); 45 INIT_LIST_HEAD(&logger->list[i]);
46 46
47 mutex_lock(&nf_log_mutex); 47 mutex_lock(&nf_log_mutex);
48 48
49 if (pf == NFPROTO_UNSPEC) { 49 if (pf == NFPROTO_UNSPEC) {
50 int i;
51 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) 50 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
52 list_add_tail(&(logger->list[i]), &(nf_loggers_l[i])); 51 list_add_tail(&(logger->list[i]), &(nf_loggers_l[i]));
53 } else { 52 } else {
54 /* register at end of list to honor first register win */ 53 /* register at end of list to honor first register win */
55 list_add_tail(&logger->list[pf], &nf_loggers_l[pf]); 54 list_add_tail(&logger->list[pf], &nf_loggers_l[pf]);
56 llog = rcu_dereference(nf_loggers[pf]); 55 llog = rcu_dereference(nf_loggers[pf]);
57 if (llog == NULL) 56 if (llog == NULL)
58 rcu_assign_pointer(nf_loggers[pf], logger); 57 rcu_assign_pointer(nf_loggers[pf], logger);
59 } 58 }
60 59
61 mutex_unlock(&nf_log_mutex); 60 mutex_unlock(&nf_log_mutex);
62 61
63 return 0; 62 return 0;
64 } 63 }
65 EXPORT_SYMBOL(nf_log_register); 64 EXPORT_SYMBOL(nf_log_register);
66 65
67 void nf_log_unregister(struct nf_logger *logger) 66 void nf_log_unregister(struct nf_logger *logger)
68 { 67 {
69 const struct nf_logger *c_logger; 68 const struct nf_logger *c_logger;
70 int i; 69 int i;
71 70
72 mutex_lock(&nf_log_mutex); 71 mutex_lock(&nf_log_mutex);
73 for (i = 0; i < ARRAY_SIZE(nf_loggers); i++) { 72 for (i = 0; i < ARRAY_SIZE(nf_loggers); i++) {
74 c_logger = rcu_dereference(nf_loggers[i]); 73 c_logger = rcu_dereference(nf_loggers[i]);
75 if (c_logger == logger) 74 if (c_logger == logger)
76 rcu_assign_pointer(nf_loggers[i], NULL); 75 rcu_assign_pointer(nf_loggers[i], NULL);
77 list_del(&logger->list[i]); 76 list_del(&logger->list[i]);
78 } 77 }
79 mutex_unlock(&nf_log_mutex); 78 mutex_unlock(&nf_log_mutex);
80 79
81 synchronize_rcu(); 80 synchronize_rcu();
82 } 81 }
83 EXPORT_SYMBOL(nf_log_unregister); 82 EXPORT_SYMBOL(nf_log_unregister);
84 83
85 int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger) 84 int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
86 { 85 {
87 mutex_lock(&nf_log_mutex); 86 mutex_lock(&nf_log_mutex);
88 if (__find_logger(pf, logger->name) == NULL) { 87 if (__find_logger(pf, logger->name) == NULL) {
89 mutex_unlock(&nf_log_mutex); 88 mutex_unlock(&nf_log_mutex);
90 return -ENOENT; 89 return -ENOENT;
91 } 90 }
92 rcu_assign_pointer(nf_loggers[pf], logger); 91 rcu_assign_pointer(nf_loggers[pf], logger);
93 mutex_unlock(&nf_log_mutex); 92 mutex_unlock(&nf_log_mutex);
94 return 0; 93 return 0;
95 } 94 }
96 EXPORT_SYMBOL(nf_log_bind_pf); 95 EXPORT_SYMBOL(nf_log_bind_pf);
97 96
98 void nf_log_unbind_pf(u_int8_t pf) 97 void nf_log_unbind_pf(u_int8_t pf)
99 { 98 {
100 mutex_lock(&nf_log_mutex); 99 mutex_lock(&nf_log_mutex);
101 rcu_assign_pointer(nf_loggers[pf], NULL); 100 rcu_assign_pointer(nf_loggers[pf], NULL);
102 mutex_unlock(&nf_log_mutex); 101 mutex_unlock(&nf_log_mutex);
103 } 102 }
104 EXPORT_SYMBOL(nf_log_unbind_pf); 103 EXPORT_SYMBOL(nf_log_unbind_pf);
105 104
106 void nf_log_packet(u_int8_t pf, 105 void nf_log_packet(u_int8_t pf,
107 unsigned int hooknum, 106 unsigned int hooknum,
108 const struct sk_buff *skb, 107 const struct sk_buff *skb,
109 const struct net_device *in, 108 const struct net_device *in,
110 const struct net_device *out, 109 const struct net_device *out,
111 const struct nf_loginfo *loginfo, 110 const struct nf_loginfo *loginfo,
112 const char *fmt, ...) 111 const char *fmt, ...)
113 { 112 {
114 va_list args; 113 va_list args;
115 char prefix[NF_LOG_PREFIXLEN]; 114 char prefix[NF_LOG_PREFIXLEN];
116 const struct nf_logger *logger; 115 const struct nf_logger *logger;
117 116
118 rcu_read_lock(); 117 rcu_read_lock();
119 logger = rcu_dereference(nf_loggers[pf]); 118 logger = rcu_dereference(nf_loggers[pf]);
120 if (logger) { 119 if (logger) {
121 va_start(args, fmt); 120 va_start(args, fmt);
122 vsnprintf(prefix, sizeof(prefix), fmt, args); 121 vsnprintf(prefix, sizeof(prefix), fmt, args);
123 va_end(args); 122 va_end(args);
124 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix); 123 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
125 } 124 }
126 rcu_read_unlock(); 125 rcu_read_unlock();
127 } 126 }
128 EXPORT_SYMBOL(nf_log_packet); 127 EXPORT_SYMBOL(nf_log_packet);
129 128
130 #ifdef CONFIG_PROC_FS 129 #ifdef CONFIG_PROC_FS
131 static void *seq_start(struct seq_file *seq, loff_t *pos) 130 static void *seq_start(struct seq_file *seq, loff_t *pos)
132 __acquires(RCU) 131 __acquires(RCU)
133 { 132 {
134 rcu_read_lock(); 133 rcu_read_lock();
135 134
136 if (*pos >= ARRAY_SIZE(nf_loggers)) 135 if (*pos >= ARRAY_SIZE(nf_loggers))
137 return NULL; 136 return NULL;
138 137
139 return pos; 138 return pos;
140 } 139 }
141 140
142 static void *seq_next(struct seq_file *s, void *v, loff_t *pos) 141 static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
143 { 142 {
144 (*pos)++; 143 (*pos)++;
145 144
146 if (*pos >= ARRAY_SIZE(nf_loggers)) 145 if (*pos >= ARRAY_SIZE(nf_loggers))
147 return NULL; 146 return NULL;
148 147
149 return pos; 148 return pos;
150 } 149 }
151 150
152 static void seq_stop(struct seq_file *s, void *v) 151 static void seq_stop(struct seq_file *s, void *v)
153 __releases(RCU) 152 __releases(RCU)
154 { 153 {
155 rcu_read_unlock(); 154 rcu_read_unlock();
156 } 155 }
157 156
158 static int seq_show(struct seq_file *s, void *v) 157 static int seq_show(struct seq_file *s, void *v)
159 { 158 {
160 loff_t *pos = v; 159 loff_t *pos = v;
161 const struct nf_logger *logger; 160 const struct nf_logger *logger;
162 struct nf_logger *t; 161 struct nf_logger *t;
163 int ret; 162 int ret;
164 163
165 logger = rcu_dereference(nf_loggers[*pos]); 164 logger = rcu_dereference(nf_loggers[*pos]);
166 165
167 if (!logger) 166 if (!logger)
168 ret = seq_printf(s, "%2lld NONE (", *pos); 167 ret = seq_printf(s, "%2lld NONE (", *pos);
169 else 168 else
170 ret = seq_printf(s, "%2lld %s (", *pos, logger->name); 169 ret = seq_printf(s, "%2lld %s (", *pos, logger->name);
171 170
172 if (ret < 0) 171 if (ret < 0)
173 return ret; 172 return ret;
174 173
175 mutex_lock(&nf_log_mutex); 174 mutex_lock(&nf_log_mutex);
176 list_for_each_entry(t, &nf_loggers_l[*pos], list[*pos]) { 175 list_for_each_entry(t, &nf_loggers_l[*pos], list[*pos]) {
177 ret = seq_printf(s, "%s", t->name); 176 ret = seq_printf(s, "%s", t->name);
178 if (ret < 0) { 177 if (ret < 0) {
179 mutex_unlock(&nf_log_mutex); 178 mutex_unlock(&nf_log_mutex);
180 return ret; 179 return ret;
181 } 180 }
182 if (&t->list[*pos] != nf_loggers_l[*pos].prev) { 181 if (&t->list[*pos] != nf_loggers_l[*pos].prev) {
183 ret = seq_printf(s, ","); 182 ret = seq_printf(s, ",");
184 if (ret < 0) { 183 if (ret < 0) {
185 mutex_unlock(&nf_log_mutex); 184 mutex_unlock(&nf_log_mutex);
186 return ret; 185 return ret;
187 } 186 }
188 } 187 }
189 } 188 }
190 mutex_unlock(&nf_log_mutex); 189 mutex_unlock(&nf_log_mutex);
191 190
192 return seq_printf(s, ")\n"); 191 return seq_printf(s, ")\n");
193 } 192 }
194 193
195 static const struct seq_operations nflog_seq_ops = { 194 static const struct seq_operations nflog_seq_ops = {
196 .start = seq_start, 195 .start = seq_start,
197 .next = seq_next, 196 .next = seq_next,
198 .stop = seq_stop, 197 .stop = seq_stop,
199 .show = seq_show, 198 .show = seq_show,
200 }; 199 };
201 200
202 static int nflog_open(struct inode *inode, struct file *file) 201 static int nflog_open(struct inode *inode, struct file *file)
203 { 202 {
204 return seq_open(file, &nflog_seq_ops); 203 return seq_open(file, &nflog_seq_ops);
205 } 204 }
206 205
207 static const struct file_operations nflog_file_ops = { 206 static const struct file_operations nflog_file_ops = {
208 .owner = THIS_MODULE, 207 .owner = THIS_MODULE,
209 .open = nflog_open, 208 .open = nflog_open,
210 .read = seq_read, 209 .read = seq_read,
211 .llseek = seq_lseek, 210 .llseek = seq_lseek,
212 .release = seq_release, 211 .release = seq_release,
213 }; 212 };
214 213
215 214
216 #endif /* PROC_FS */ 215 #endif /* PROC_FS */
217 216
218 #ifdef CONFIG_SYSCTL 217 #ifdef CONFIG_SYSCTL
219 struct ctl_path nf_log_sysctl_path[] = { 218 static struct ctl_path nf_log_sysctl_path[] = {
220 { .procname = "net", .ctl_name = CTL_NET, }, 219 { .procname = "net", .ctl_name = CTL_NET, },
221 { .procname = "netfilter", .ctl_name = NET_NETFILTER, }, 220 { .procname = "netfilter", .ctl_name = NET_NETFILTER, },
222 { .procname = "nf_log", .ctl_name = CTL_UNNUMBERED, }, 221 { .procname = "nf_log", .ctl_name = CTL_UNNUMBERED, },
223 { } 222 { }
224 }; 223 };
225 224
226 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3]; 225 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
227 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1]; 226 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
228 static struct ctl_table_header *nf_log_dir_header; 227 static struct ctl_table_header *nf_log_dir_header;
229 228
230 static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp, 229 static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp,
231 void *buffer, size_t *lenp, loff_t *ppos) 230 void __user *buffer, size_t *lenp, loff_t *ppos)
232 { 231 {
233 const struct nf_logger *logger; 232 const struct nf_logger *logger;
233 char buf[NFLOGGER_NAME_LEN];
234 size_t size = *lenp;
234 int r = 0; 235 int r = 0;
235 int tindex = (unsigned long)table->extra1; 236 int tindex = (unsigned long)table->extra1;
236 237
237 if (write) { 238 if (write) {
238 if (!strcmp(buffer, "NONE")) { 239 if (size > sizeof(buf))
240 size = sizeof(buf);
241 if (copy_from_user(buf, buffer, size))
242 return -EFAULT;
243
244 if (!strcmp(buf, "NONE")) {
239 nf_log_unbind_pf(tindex); 245 nf_log_unbind_pf(tindex);
240 return 0; 246 return 0;
241 } 247 }
242 mutex_lock(&nf_log_mutex); 248 mutex_lock(&nf_log_mutex);
243 logger = __find_logger(tindex, buffer); 249 logger = __find_logger(tindex, buf);
244 if (logger == NULL) { 250 if (logger == NULL) {
245 mutex_unlock(&nf_log_mutex); 251 mutex_unlock(&nf_log_mutex);
246 return -ENOENT; 252 return -ENOENT;
247 } 253 }
248 rcu_assign_pointer(nf_loggers[tindex], logger); 254 rcu_assign_pointer(nf_loggers[tindex], logger);
249 mutex_unlock(&nf_log_mutex); 255 mutex_unlock(&nf_log_mutex);
250 } else { 256 } else {
251 mutex_lock(&nf_log_mutex); 257 mutex_lock(&nf_log_mutex);
252 logger = nf_loggers[tindex]; 258 logger = nf_loggers[tindex];
253 if (!logger) 259 if (!logger)
254 table->data = "NONE"; 260 table->data = "NONE";
255 else 261 else
256 table->data = logger->name; 262 table->data = logger->name;
257 r = proc_dostring(table, write, filp, buffer, lenp, ppos); 263 r = proc_dostring(table, write, filp, buffer, lenp, ppos);
258 mutex_unlock(&nf_log_mutex); 264 mutex_unlock(&nf_log_mutex);
259 } 265 }
260 266
261 return r; 267 return r;
262 } 268 }
263 269
264 static __init int netfilter_log_sysctl_init(void) 270 static __init int netfilter_log_sysctl_init(void)
265 { 271 {
266 int i; 272 int i;
267 273
268 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) { 274 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) {
269 snprintf(nf_log_sysctl_fnames[i-NFPROTO_UNSPEC], 3, "%d", i); 275 snprintf(nf_log_sysctl_fnames[i-NFPROTO_UNSPEC], 3, "%d", i);
270 nf_log_sysctl_table[i].ctl_name = CTL_UNNUMBERED; 276 nf_log_sysctl_table[i].ctl_name = CTL_UNNUMBERED;
271 nf_log_sysctl_table[i].procname = 277 nf_log_sysctl_table[i].procname =
272 nf_log_sysctl_fnames[i-NFPROTO_UNSPEC]; 278 nf_log_sysctl_fnames[i-NFPROTO_UNSPEC];
273 nf_log_sysctl_table[i].data = NULL; 279 nf_log_sysctl_table[i].data = NULL;
274 nf_log_sysctl_table[i].maxlen = 280 nf_log_sysctl_table[i].maxlen =
275 NFLOGGER_NAME_LEN * sizeof(char); 281 NFLOGGER_NAME_LEN * sizeof(char);
276 nf_log_sysctl_table[i].mode = 0644; 282 nf_log_sysctl_table[i].mode = 0644;
277 nf_log_sysctl_table[i].proc_handler = nf_log_proc_dostring; 283 nf_log_sysctl_table[i].proc_handler = nf_log_proc_dostring;
278 nf_log_sysctl_table[i].extra1 = (void *)(unsigned long) i; 284 nf_log_sysctl_table[i].extra1 = (void *)(unsigned long) i;
279 } 285 }
280 286
281 nf_log_dir_header = register_sysctl_paths(nf_log_sysctl_path, 287 nf_log_dir_header = register_sysctl_paths(nf_log_sysctl_path,
282 nf_log_sysctl_table); 288 nf_log_sysctl_table);
283 if (!nf_log_dir_header) 289 if (!nf_log_dir_header)
284 return -ENOMEM; 290 return -ENOMEM;
285 291
286 return 0; 292 return 0;
287 } 293 }
288 #else 294 #else
289 static __init int netfilter_log_sysctl_init(void) 295 static __init int netfilter_log_sysctl_init(void)
290 { 296 {
291 return 0; 297 return 0;
292 } 298 }
293 #endif /* CONFIG_SYSCTL */ 299 #endif /* CONFIG_SYSCTL */
294 300
295 int __init netfilter_log_init(void) 301 int __init netfilter_log_init(void)
296 { 302 {
297 int i, r; 303 int i, r;
298 #ifdef CONFIG_PROC_FS 304 #ifdef CONFIG_PROC_FS
299 if (!proc_create("nf_log", S_IRUGO, 305 if (!proc_create("nf_log", S_IRUGO,
300 proc_net_netfilter, &nflog_file_ops)) 306 proc_net_netfilter, &nflog_file_ops))
301 return -1; 307 return -1;
302 #endif 308 #endif
303 309
304 /* Errors will trigger panic, unroll on error is unnecessary. */ 310 /* Errors will trigger panic, unroll on error is unnecessary. */
305 r = netfilter_log_sysctl_init(); 311 r = netfilter_log_sysctl_init();
306 if (r < 0) 312 if (r < 0)
307 return r; 313 return r;
308 314
309 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++) 315 for (i = NFPROTO_UNSPEC; i < NFPROTO_NUMPROTO; i++)
310 INIT_LIST_HEAD(&(nf_loggers_l[i])); 316 INIT_LIST_HEAD(&(nf_loggers_l[i]));
311 317
312 return 0; 318 return 0;
313 } 319 }