linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Petr Machata <petrm@nvidia.com>,
	Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 4.9 30/35] net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
Date: Fri, 22 Jan 2021 15:10:32 +0100	[thread overview]
Message-ID: <20210122135733.517950842@linuxfoundation.org> (raw)
In-Reply-To: <20210122135732.357969201@linuxfoundation.org>

From: Petr Machata <petrm@nvidia.com>

[ Upstream commit df85bc140a4d6cbaa78d8e9c35154e1a2f0622c7 ]

In commit 826f328e2b7e ("net: dcb: Validate netlink message in DCB
handler"), Linux started rejecting RTM_GETDCB netlink messages if they
contained a set-like DCB_CMD_ command.

The reason was that privileges were only verified for RTM_SETDCB messages,
but the value that determined the action to be taken is the command, not
the message type. And validation of message type against the DCB command
was the obvious missing piece.

Unfortunately it turns out that mlnx_qos, a somewhat widely deployed tool
for configuration of DCB, accesses the DCB set-like APIs through
RTM_GETDCB.

Therefore do not bounce the discrepancy between message type and command.
Instead, in addition to validating privileges based on the actual message
type, validate them also based on the expected message type. This closes
the loophole of allowing DCB configuration on non-admin accounts, while
maintaining backward compatibility.

Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver")
Fixes: 826f328e2b7e ("net: dcb: Validate netlink message in DCB handler")
Signed-off-by: Petr Machata <petrm@nvidia.com>
Link: https://lore.kernel.org/r/a3edcfda0825f2aa2591801c5232f2bbf2d8a554.1610384801.git.me@pmachata.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dcb/dcbnl.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1726,7 +1726,7 @@ static int dcb_doit(struct sk_buff *skb,
 	fn = &reply_funcs[dcb->cmd];
 	if (!fn->cb)
 		return -EOPNOTSUPP;
-	if (fn->type != nlh->nlmsg_type)
+	if (fn->type == RTM_SETDCB && !netlink_capable(skb, CAP_NET_ADMIN))
 		return -EPERM;
 
 	if (!tb[DCB_ATTR_IFNAME])



  parent reply	other threads:[~2021-01-22 20:00 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-22 14:10 [PATCH 4.9 00/35] 4.9.253-rc1 review Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 01/35] ASoC: dapm: remove widget from dirty list on free Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 02/35] MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 03/35] MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 04/35] MIPS: relocatable: fix possible boot hangup with KASLR enabled Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 05/35] ACPI: scan: Harden acpi_device_add() against device ID overflows Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 06/35] mm/hugetlb: fix potential missing huge page size info Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 07/35] ext4: fix bug for rename with RENAME_WHITEOUT Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 08/35] ARC: build: add boot_targets to PHONY Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 09/35] ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 10/35] arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 11/35] misdn: dsp: select CONFIG_BITREVERSE Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 12/35] net: ethernet: fs_enet: Add missing MODULE_LICENSE Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 13/35] ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 14/35] ARM: picoxcell: fix missing interrupt-parent properties Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 15/35] Input: uinput - avoid FF flush when destroying device Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 16/35] dump_common_audit_data(): fix racy accesses to ->d_name Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 17/35] NFS: nfs_igrab_and_active must first reference the superblock Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 18/35] ext4: fix superblock checksum failure when setting password salt Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 19/35] RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 20/35] mm, slub: consider rest of partial list if acquire_slab() fails Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 21/35] net: sunrpc: interpret the return value of kstrtou32 correctly Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 22/35] netfilter: conntrack: fix reading nf_conntrack_buckets Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 23/35] usb: ohci: Make distrust_firmware param default to false Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 24/35] compiler.h: Raise minimum version of GCC to 5.1 for arm64 Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 25/35] nfsd4: readdirplus shouldnt return parent of export Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 26/35] net: cdc_ncm: correct overhead in delayed_ndp_size Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 27/35] netxen_nic: fix MSI/MSI-x interrupts Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 28/35] rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 29/35] net: dcb: Validate netlink message in DCB handler Greg Kroah-Hartman
2021-01-22 14:10 ` Greg Kroah-Hartman [this message]
2021-01-22 14:10 ` [PATCH 4.9 31/35] net: sit: unregister_netdevice on newlinks error path Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 32/35] net: avoid 32 x truesize under-estimation for tiny skbs Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 33/35] rxrpc: Fix handling of an unsupported token type in rxrpc_read() Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 34/35] tipc: fix NULL deref in tipc_link_xmit() Greg Kroah-Hartman
2021-01-22 14:10 ` [PATCH 4.9 35/35] spi: cadence: cache reference clock rate during probe Greg Kroah-Hartman
2021-01-23  0:25 ` [PATCH 4.9 00/35] 4.9.253-rc1 review Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210122135733.517950842@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=petrm@nvidia.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).