From: hujunwei <hujunwei4@huawei.com> To: <wensong@linux-vs.org>, <horms@verge.net.au>, <pablo@netfilter.org>, <kadlec@blackhole.kfki.hu>, <fw@strlen.de>, <davem@davemloft.net>, "Julian Anastasov" <ja@ssi.bg>, Florian Westphal <fw@strlen.de> Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>, <lvs-devel@vger.kernel.org>, <netfilter-devel@vger.kernel.org>, <coreteam@netfilter.org>, Mingfangsen <mingfangsen@huawei.com>, <wangxiaogang3@huawei.com>, <xuhanbing@huawei.com> Subject: [PATCH net v2] ipvs: Improve robustness to the ipvs sysctl Date: Tue, 30 Jul 2019 15:11:33 +0800 [thread overview] Message-ID: <4a0476d3-57a4-50e0-cae8-9dffc4f4d556@huawei.com> (raw) In-Reply-To: <1997375e-815d-137f-20c9-0829a8587ee9@huawei.com> From: Junwei Hu <hujunwei4@huawei.com> The ipvs module parse the user buffer and save it to sysctl, then check if the value is valid. invalid value occurs over a period of time. Here, I add a variable, struct ctl_table tmp, used to read the value from the user buffer, and save only when it is valid. I delete proc_do_sync_mode and use extra1/2 in table for the proc_dointvec_minmax call. Fixes: f73181c8288f ("ipvs: add support for sync threads") Signed-off-by: Junwei Hu <hujunwei4@huawei.com> --- V1->V2: - delete proc_do_sync_mode and use proc_dointvec_minmax call. --- net/netfilter/ipvs/ip_vs_ctl.c | 69 +++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 34 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 060565e..7aed7b0 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -1737,12 +1737,18 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) int val = *valp; int rc; - rc = proc_dointvec(table, write, buffer, lenp, ppos); + struct ctl_table tmp = { + .data = &val, + .maxlen = sizeof(int), + .mode = table->mode, + }; + + rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); if (write && (*valp != val)) { - if ((*valp < 0) || (*valp > 3)) { - /* Restore the correct value */ + if (val < 0 || val > 3) { + rc = -EINVAL; + } else { *valp = val; - } else { update_defense_level(ipvs); } } @@ -1756,33 +1762,20 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) int *valp = table->data; int val[2]; int rc; + struct ctl_table tmp = { + .data = &val, + .maxlen = table->maxlen, + .mode = table->mode, + }; - /* backup the value first */ memcpy(val, valp, sizeof(val)); - - rc = proc_dointvec(table, write, buffer, lenp, ppos); - if (write && (valp[0] < 0 || valp[1] < 0 || - (valp[0] >= valp[1] && valp[1]))) { - /* Restore the correct value */ - memcpy(valp, val, sizeof(val)); - } - return rc; -} - -static int -proc_do_sync_mode(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, loff_t *ppos) -{ - int *valp = table->data; - int val = *valp; - int rc; - - rc = proc_dointvec(table, write, buffer, lenp, ppos); - if (write && (*valp != val)) { - if ((*valp < 0) || (*valp > 1)) { - /* Restore the correct value */ - *valp = val; - } + rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); + if (write) { + if (val[0] < 0 || val[1] < 0 || + (val[0] >= val[1] && val[1])) + rc = -EINVAL; + else + memcpy(valp, val, sizeof(val)); } return rc; } @@ -1795,12 +1788,18 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) int val = *valp; int rc; - rc = proc_dointvec(table, write, buffer, lenp, ppos); + struct ctl_table tmp = { + .data = &val, + .maxlen = sizeof(int), + .mode = table->mode, + }; + + rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); if (write && (*valp != val)) { - if (*valp < 1 || !is_power_of_2(*valp)) { - /* Restore the correct value */ + if (val < 1 || !is_power_of_2(val)) + rc = -EINVAL; + else *valp = val; - } } return rc; } @@ -1860,7 +1859,9 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) .procname = "sync_version", .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_do_sync_mode, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, }, { .procname = "sync_ports", -- 1.7.12.4
WARNING: multiple messages have this Message-ID (diff)
From: hujunwei <hujunwei4@huawei.com> To: wensong@linux-vs.org, horms@verge.net.au, pablo@netfilter.org, kadlec@blackhole.kfki.hu, fw@strlen.de, davem@davemloft.net, Julian Anastasov <ja@ssi.bg>, Florian Westphal <fw@strlen.de> Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>, lvs-devel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, Mingfangsen <mingfangsen@huawei.com>, wangxiaogang3@huawei.com, xuhanbing@huawei.com Subject: [PATCH net v2] ipvs: Improve robustness to the ipvs sysctl Date: Tue, 30 Jul 2019 15:11:33 +0800 [thread overview] Message-ID: <4a0476d3-57a4-50e0-cae8-9dffc4f4d556@huawei.com> (raw) In-Reply-To: <1997375e-815d-137f-20c9-0829a8587ee9@huawei.com> From: Junwei Hu <hujunwei4@huawei.com> The ipvs module parse the user buffer and save it to sysctl, then check if the value is valid. invalid value occurs over a period of time. Here, I add a variable, struct ctl_table tmp, used to read the value from the user buffer, and save only when it is valid. I delete proc_do_sync_mode and use extra1/2 in table for the proc_dointvec_minmax call. Fixes: f73181c8288f ("ipvs: add support for sync threads") Signed-off-by: Junwei Hu <hujunwei4@huawei.com> --- V1->V2: - delete proc_do_sync_mode and use proc_dointvec_minmax call. --- net/netfilter/ipvs/ip_vs_ctl.c | 69 +++++++++++++++++++++--------------------- 1 file changed, 35 insertions(+), 34 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index 060565e..7aed7b0 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -1737,12 +1737,18 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) int val = *valp; int rc; - rc = proc_dointvec(table, write, buffer, lenp, ppos); + struct ctl_table tmp = { + .data = &val, + .maxlen = sizeof(int), + .mode = table->mode, + }; + + rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); if (write && (*valp != val)) { - if ((*valp < 0) || (*valp > 3)) { - /* Restore the correct value */ + if (val < 0 || val > 3) { + rc = -EINVAL; + } else { *valp = val; - } else { update_defense_level(ipvs); } } @@ -1756,33 +1762,20 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) int *valp = table->data; int val[2]; int rc; + struct ctl_table tmp = { + .data = &val, + .maxlen = table->maxlen, + .mode = table->mode, + }; - /* backup the value first */ memcpy(val, valp, sizeof(val)); - - rc = proc_dointvec(table, write, buffer, lenp, ppos); - if (write && (valp[0] < 0 || valp[1] < 0 || - (valp[0] >= valp[1] && valp[1]))) { - /* Restore the correct value */ - memcpy(valp, val, sizeof(val)); - } - return rc; -} - -static int -proc_do_sync_mode(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, loff_t *ppos) -{ - int *valp = table->data; - int val = *valp; - int rc; - - rc = proc_dointvec(table, write, buffer, lenp, ppos); - if (write && (*valp != val)) { - if ((*valp < 0) || (*valp > 1)) { - /* Restore the correct value */ - *valp = val; - } + rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); + if (write) { + if (val[0] < 0 || val[1] < 0 || + (val[0] >= val[1] && val[1])) + rc = -EINVAL; + else + memcpy(valp, val, sizeof(val)); } return rc; } @@ -1795,12 +1788,18 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) int val = *valp; int rc; - rc = proc_dointvec(table, write, buffer, lenp, ppos); + struct ctl_table tmp = { + .data = &val, + .maxlen = sizeof(int), + .mode = table->mode, + }; + + rc = proc_dointvec(&tmp, write, buffer, lenp, ppos); if (write && (*valp != val)) { - if (*valp < 1 || !is_power_of_2(*valp)) { - /* Restore the correct value */ + if (val < 1 || !is_power_of_2(val)) + rc = -EINVAL; + else *valp = val; - } } return rc; } @@ -1860,7 +1859,9 @@ static int ip_vs_zero_all(struct netns_ipvs *ipvs) .procname = "sync_version", .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_do_sync_mode, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, }, { .procname = "sync_ports", -- 1.7.12.4
next prev parent reply other threads:[~2019-07-30 7:12 UTC|newest] Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-07-15 14:48 [PATCH net] ipvs: Improve robustness to the ipvs sysctl hujunwei 2019-07-15 14:48 ` hujunwei 2019-07-29 0:49 ` Florian Westphal 2019-07-29 14:58 ` hujunwei 2019-07-29 20:20 ` Julian Anastasov 2019-07-30 2:23 ` hujunwei 2019-07-30 7:11 ` hujunwei [this message] 2019-07-30 7:11 ` [PATCH net v2] " hujunwei 2019-07-30 19:29 ` Julian Anastasov 2019-07-30 19:29 ` Julian Anastasov 2019-07-31 15:58 ` hujunwei 2019-07-31 15:58 ` hujunwei 2019-07-31 16:03 ` [PATCH net v3] " hujunwei 2019-07-31 16:03 ` hujunwei 2019-07-31 17:53 ` Julian Anastasov 2019-07-31 17:53 ` Julian Anastasov 2019-08-03 16:40 ` Pablo Neira Ayuso
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=4a0476d3-57a4-50e0-cae8-9dffc4f4d556@huawei.com \ --to=hujunwei4@huawei.com \ --cc=coreteam@netfilter.org \ --cc=davem@davemloft.net \ --cc=fw@strlen.de \ --cc=horms@verge.net.au \ --cc=ja@ssi.bg \ --cc=kadlec@blackhole.kfki.hu \ --cc=lvs-devel@vger.kernel.org \ --cc=mingfangsen@huawei.com \ --cc=netdev@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=pablo@netfilter.org \ --cc=wangxiaogang3@huawei.com \ --cc=wensong@linux-vs.org \ --cc=xuhanbing@huawei.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.