Re: [PATCH] [NET]: fix multicast list when cloning sockets
From: Flavio Leitner <[EMAIL PROTECTED]>
Date: Tue, 31 Jul 2007 15:29:40 -0300
> On Tue, Jul 31, 2007 at 12:00:41AM -0300, Arnaldo Carvalho de Melo wrote:
> > On 7/30/07, David Miller <[EMAIL PROTECTED]> wrote:
> > > Allowing non-datagram sockets to end up with a non-NULL inet->mc_list
> > > in the first place is a bug.
> > >
> > > Multicast subscriptions cannot even be used with TCP and DCCP, which
> > > are the only two users of these connection oriented socket functions.
> > >
> > > The first thing that TCP and DCCP do, in fact, for input packet
> > > processing is drop the packet if it is not unicast.
> > >
> > > Therefore the fix really is for the inet layer to reject multicast
> > > subscription requests on sockets for which that absolutely does not
> > > make sense. There is no reason these functions in
> > > inet_connection_sock.c should need to be mindful of multicast
> > > state. :-)
> >
> > Well, we can add a BUG_ON there then 8)
> >
> > Flavio, take a look at do_ip_setsockopt in net/ipv4/ip_sockglue.c, in
> > the IP_{ADD,DROP}_MEMBERSHIP labels.
> >
> > Don't forget IPV6 (net/ipv6/ipv6_sockglue.c)
>
> yes, right. What about the one below?
>
> [NET]: Fix IP_ADD/DROP_MEMBERSHIP to handle only connectionless
>
> Fix IP[V6]_ADD_MEMBERSHIP and IP[V6]_DROP_MEMBERSHIP to
> return -EPROTO for connection oriented sockets.
>
> Signed-off-by: Flavio Leitner <[EMAIL PROTECTED]>
This looks great, patch applied.
Thanks!
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] [NET]: fix multicast list when cloning sockets
On Tue, Jul 31, 2007 at 12:00:41AM -0300, Arnaldo Carvalho de Melo wrote:
> On 7/30/07, David Miller <[EMAIL PROTECTED]> wrote:
> > Allowing non-datagram sockets to end up with a non-NULL inet->mc_list
> > in the first place is a bug.
> >
> > Multicast subscriptions cannot even be used with TCP and DCCP, which
> > are the only two users of these connection oriented socket functions.
> >
> > The first thing that TCP and DCCP do, in fact, for input packet
> > processing is drop the packet if it is not unicast.
> >
> > Therefore the fix really is for the inet layer to reject multicast
> > subscription requests on sockets for which that absolutely does not
> > make sense. There is no reason these functions in
> > inet_connection_sock.c should need to be mindful of multicast
> > state. :-)
>
> Well, we can add a BUG_ON there then 8)
>
> Flavio, take a look at do_ip_setsockopt in net/ipv4/ip_sockglue.c, in
> the IP_{ADD,DROP}_MEMBERSHIP labels.
>
> Don't forget IPV6 (net/ipv6/ipv6_sockglue.c)
yes, right. What about the one below?
[NET]: Fix IP_ADD/DROP_MEMBERSHIP to handle only connectionless
Fix IP[V6]_ADD_MEMBERSHIP and IP[V6]_DROP_MEMBERSHIP to
return -EPROTO for connection oriented sockets.
Signed-off-by: Flavio Leitner <[EMAIL PROTECTED]>
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 4d54457..6b420ae 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -625,6 +625,10 @@ static int do_ip_setsockopt(struct sock *sk, int level,
{
struct ip_mreqn mreq;
+ err = -EPROTO;
+ if (inet_sk(sk)->is_icsk)
+ break;
+
if (optlen < sizeof(struct ip_mreq))
goto e_inval;
err = -EFAULT;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index d684639..350e584 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -554,6 +554,10 @@ done:
{
struct ipv6_mreq mreq;
+ retv = -EPROTO;
+ if (inet_sk(sk)->is_icsk)
+ break;
+
retv = -EFAULT;
if (copy_from_user(&mreq, optval, sizeof(struct ipv6_mreq)))
break;
--
1.5.2.4
--
Flavio
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] [NET]: fix multicast list when cloning sockets
On 7/30/07, David Miller <[EMAIL PROTECTED]> wrote:
> From: Flavio Leitner <[EMAIL PROTECTED]>
> Date: Mon, 30 Jul 2007 13:04:48 -0300
>
> >
> > The sock_copy() function uses memcpy() to clone the socket
> > including the struct ip_mc_socklist *mc_list pointer.
> >
> > The ip_mc_drop_socket() function is called when socket is closed
> > to free these objects leaving the other sockets cloned from the
> > same master socket with invalid pointers.
> >
> > This patch sets mc_list of cloned socket to NULL.
> >
> > Signed-off-by: Flavio Leitner <[EMAIL PROTECTED]>
>
> Allowing non-datagram sockets to end up with a non-NULL inet->mc_list
> in the first place is a bug.
>
> Multicast subscriptions cannot even be used with TCP and DCCP, which
> are the only two users of these connection oriented socket functions.
>
> The first thing that TCP and DCCP do, in fact, for input packet
> processing is drop the packet if it is not unicast.
>
> Therefore the fix really is for the inet layer to reject multicast
> subscription requests on sockets for which that absolutely does not
> make sense. There is no reason these functions in
> inet_connection_sock.c should need to be mindful of multicast
> state. :-)
Well, we can add a BUG_ON there then 8)
Flavio, take a look at do_ip_setsockopt in net/ipv4/ip_sockglue.c, in
the IP_{ADD,DROP}_MEMBERSHIP labels.
Don't forget IPV6 (net/ipv6/ipv6_sockglue.c)
- Arnaldo
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: [PATCH] [NET]: fix multicast list when cloning sockets
From: Flavio Leitner <[EMAIL PROTECTED]> Date: Mon, 30 Jul 2007 13:04:48 -0300 > > The sock_copy() function uses memcpy() to clone the socket > including the struct ip_mc_socklist *mc_list pointer. > > The ip_mc_drop_socket() function is called when socket is closed > to free these objects leaving the other sockets cloned from the > same master socket with invalid pointers. > > This patch sets mc_list of cloned socket to NULL. > > Signed-off-by: Flavio Leitner <[EMAIL PROTECTED]> Allowing non-datagram sockets to end up with a non-NULL inet->mc_list in the first place is a bug. Multicast subscriptions cannot even be used with TCP and DCCP, which are the only two users of these connection oriented socket functions. The first thing that TCP and DCCP do, in fact, for input packet processing is drop the packet if it is not unicast. Therefore the fix really is for the inet layer to reject multicast subscription requests on sockets for which that absolutely does not make sense. There is no reason these functions in inet_connection_sock.c should need to be mindful of multicast state. :-) - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH] [NET]: fix multicast list when cloning sockets
The sock_copy() function uses memcpy() to clone the socket including the struct ip_mc_socklist *mc_list pointer. The ip_mc_drop_socket() function is called when socket is closed to free these objects leaving the other sockets cloned from the same master socket with invalid pointers. This patch sets mc_list of cloned socket to NULL. Signed-off-by: Flavio Leitner <[EMAIL PROTECTED]> diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index fbe7714..8ee0f54 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -506,6 +506,8 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req, newicsk->icsk_backoff = 0; newicsk->icsk_probes_out = 0; + inet_sk(inet)->mc_list = NULL; + /* Deinitialize accept_queue to trap illegal accesses. */ memset(&newicsk->icsk_accept_queue, 0, sizeof(newicsk->icsk_accept_queue)); -- 1.5.2.4 -- Flavio - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
