Commit 9b64e93e authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Paolo Abeni
Browse files

llc: Check netns in llc_dgram_match(). 



We will remove this restriction in llc_rcv() soon, which means that the
protocol handler must be aware of netns.

	if (!net_eq(dev_net(dev), &init_net))
		goto drop;

llc_rcv() fetches llc_type_handlers[llc_pdu_type(skb) - 1] and calls it
if not NULL.

If the PDU type is LLC_DEST_SAP, llc_sap_handler() is called to pass skb
to corresponding sockets.  Then, we must look up a proper socket in the
same netns with skb->dev.

If the destination is a multicast address, llc_sap_handler() calls
llc_sap_mcast().  It calculates a hash based on DSAP and skb->dev->ifindex,
iterates on a socket list, and calls llc_mcast_match() to check if the
socket is the correct destination.  Then, llc_mcast_match() checks if
skb->dev matches with llc_sk(sk)->dev.  So, we need not check netns here.

OTOH, if the destination is a unicast address, llc_sap_handler() calls
llc_lookup_dgram() to look up a socket, but it does not check the netns.

Therefore, we need to add netns check in llc_lookup_dgram().

Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 9f9d4c1a

net/llc/llc_sap.c

+11 −7
Original line number Diff line number Diff line
@@ -294,11 +294,13 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb, 


static inline bool llc_dgram_match(const struct llc_sap *sap,

				   const struct llc_addr *laddr,

				   const struct sock *sk)

				   const struct sock *sk,

				   const struct net *net)

{

     struct llc_sock *llc = llc_sk(sk);



     return sk->sk_type == SOCK_DGRAM &&

	     net_eq(sock_net(sk), net) &&

	     llc->laddr.lsap == laddr->lsap &&

	     ether_addr_equal(llc->laddr.mac, laddr->mac);

}
@@ -307,12 +309,14 @@ static inline bool llc_dgram_match(const struct llc_sap *sap, 
 *	llc_lookup_dgram - Finds dgram socket for the local sap/mac

 *	@sap: SAP

 *	@laddr: address of local LLC (MAC + SAP)

 *	@net: netns to look up a socket in

 *

 *	Search socket list of the SAP and finds connection using the local

 *	mac, and local sap. Returns pointer for socket found, %NULL otherwise.

 */

static struct sock *llc_lookup_dgram(struct llc_sap *sap,

				     const struct llc_addr *laddr)

				     const struct llc_addr *laddr,

				     const struct net *net)

{

	struct sock *rc;

	struct hlist_nulls_node *node;
@@ -322,12 +326,12 @@ static struct sock *llc_lookup_dgram(struct llc_sap *sap, 
	rcu_read_lock_bh();

again:

	sk_nulls_for_each_rcu(rc, node, laddr_hb) {

		if (llc_dgram_match(sap, laddr, rc)) {

		if (llc_dgram_match(sap, laddr, rc, net)) {

			/* Extra checks required by SLAB_TYPESAFE_BY_RCU */

			if (unlikely(!refcount_inc_not_zero(&rc->sk_refcnt)))

				goto again;

			if (unlikely(llc_sk(rc)->sap != sap ||

				     !llc_dgram_match(sap, laddr, rc))) {

				     !llc_dgram_match(sap, laddr, rc, net))) {

				sock_put(rc);

				continue;

			}
@@ -429,7 +433,7 @@ void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb) 
		llc_sap_mcast(sap, &laddr, skb);

		kfree_skb(skb);

	} else {

		struct sock *sk = llc_lookup_dgram(sap, &laddr);

		struct sock *sk = llc_lookup_dgram(sap, &laddr, dev_net(skb->dev));

		if (sk) {

			llc_sap_rcv(sap, skb, sk);

			sock_put(sk);