From patchwork Fri Jan 22 14:08:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 369356 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 967D6C4332E for ; Fri, 22 Jan 2021 19:59:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5E6B623AFC for ; Fri, 22 Jan 2021 19:59:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730723AbhAVT62 (ORCPT ); Fri, 22 Jan 2021 14:58:28 -0500 Received: from mail.kernel.org ([198.145.29.99]:35772 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728336AbhAVONF (ORCPT ); Fri, 22 Jan 2021 09:13:05 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8469823A7E; Fri, 22 Jan 2021 14:09:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1611324582; bh=l4uhUfK/fERdFRPkg3NBFd2pXWcHnquqyXpcbHEmcUo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=chCYmhL016tyaGdlg6sbNO0NZGRGRi9EIQV55lLPlx1paGzaU3rvhH/xMK0riF7Md +0j5fjTDmbwTfN2ScKM+mnFyYraIcSpUJuPqPZdVUO8VWXGoEADtiTjuIJg9n6KrO2 4c65D1oL290l8iuLa/LS2A7pLkEM6cz4GBcjNdKc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Petr Machata , Jakub Kicinski Subject: [PATCH 4.4 27/31] net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands Date: Fri, 22 Jan 2021 15:08:41 +0100 Message-Id: <20210122135732.952886908@linuxfoundation.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210122135731.873346566@linuxfoundation.org> References: <20210122135731.873346566@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Petr Machata [ Upstream commit df85bc140a4d6cbaa78d8e9c35154e1a2f0622c7 ] In commit 826f328e2b7e ("net: dcb: Validate netlink message in DCB handler"), Linux started rejecting RTM_GETDCB netlink messages if they contained a set-like DCB_CMD_ command. The reason was that privileges were only verified for RTM_SETDCB messages, but the value that determined the action to be taken is the command, not the message type. And validation of message type against the DCB command was the obvious missing piece. Unfortunately it turns out that mlnx_qos, a somewhat widely deployed tool for configuration of DCB, accesses the DCB set-like APIs through RTM_GETDCB. Therefore do not bounce the discrepancy between message type and command. Instead, in addition to validating privileges based on the actual message type, validate them also based on the expected message type. This closes the loophole of allowing DCB configuration on non-admin accounts, while maintaining backward compatibility. Fixes: 2f90b8657ec9 ("ixgbe: this patch adds support for DCB to the kernel and ixgbe driver") Fixes: 826f328e2b7e ("net: dcb: Validate netlink message in DCB handler") Signed-off-by: Petr Machata Link: https://lore.kernel.org/r/a3edcfda0825f2aa2591801c5232f2bbf2d8a554.1610384801.git.me@pmachata.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/dcb/dcbnl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/dcb/dcbnl.c +++ b/net/dcb/dcbnl.c @@ -1725,7 +1725,7 @@ static int dcb_doit(struct sk_buff *skb, fn = &reply_funcs[dcb->cmd]; if (!fn->cb) return -EOPNOTSUPP; - if (fn->type != nlh->nlmsg_type) + if (fn->type == RTM_SETDCB && !netlink_capable(skb, CAP_NET_ADMIN)) return -EPERM; if (!tb[DCB_ATTR_IFNAME])