• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * NETLINK      Netlink attributes
4  *
5  * 		Authors:	Thomas Graf <tgraf@suug.ch>
6  * 				Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
7  */
8 
9 #include <linux/export.h>
10 #include <linux/kernel.h>
11 #include <linux/errno.h>
12 #include <linux/jiffies.h>
13 #include <linux/nospec.h>
14 #include <linux/skbuff.h>
15 #include <linux/string.h>
16 #include <linux/types.h>
17 #include <net/netlink.h>
18 
19 /* For these data types, attribute length should be exactly the given
20  * size. However, to maintain compatibility with broken commands, if the
21  * attribute length does not match the expected size a warning is emitted
22  * to the user that the command is sending invalid data and needs to be fixed.
23  */
24 static const u8 nla_attr_len[NLA_TYPE_MAX+1] = {
25 	[NLA_U8]	= sizeof(u8),
26 	[NLA_U16]	= sizeof(u16),
27 	[NLA_U32]	= sizeof(u32),
28 	[NLA_U64]	= sizeof(u64),
29 	[NLA_S8]	= sizeof(s8),
30 	[NLA_S16]	= sizeof(s16),
31 	[NLA_S32]	= sizeof(s32),
32 	[NLA_S64]	= sizeof(s64),
33 };
34 
35 static const u8 nla_attr_minlen[NLA_TYPE_MAX+1] = {
36 	[NLA_U8]	= sizeof(u8),
37 	[NLA_U16]	= sizeof(u16),
38 	[NLA_U32]	= sizeof(u32),
39 	[NLA_U64]	= sizeof(u64),
40 	[NLA_MSECS]	= sizeof(u64),
41 	[NLA_NESTED]	= NLA_HDRLEN,
42 	[NLA_S8]	= sizeof(s8),
43 	[NLA_S16]	= sizeof(s16),
44 	[NLA_S32]	= sizeof(s32),
45 	[NLA_S64]	= sizeof(s64),
46 };
47 
48 /*
49  * Nested policies might refer back to the original
50  * policy in some cases, and userspace could try to
51  * abuse that and recurse by nesting in the right
52  * ways. Limit recursion to avoid this problem.
53  */
54 #define MAX_POLICY_RECURSION_DEPTH	10
55 
56 static int __nla_validate_parse(const struct nlattr *head, int len, int maxtype,
57 				const struct nla_policy *policy,
58 				unsigned int validate,
59 				struct netlink_ext_ack *extack,
60 				struct nlattr **tb, unsigned int depth);
61 
validate_nla_bitfield32(const struct nlattr * nla,const u32 valid_flags_mask)62 static int validate_nla_bitfield32(const struct nlattr *nla,
63 				   const u32 valid_flags_mask)
64 {
65 	const struct nla_bitfield32 *bf = nla_data(nla);
66 
67 	if (!valid_flags_mask)
68 		return -EINVAL;
69 
70 	/*disallow invalid bit selector */
71 	if (bf->selector & ~valid_flags_mask)
72 		return -EINVAL;
73 
74 	/*disallow invalid bit values */
75 	if (bf->value & ~valid_flags_mask)
76 		return -EINVAL;
77 
78 	/*disallow valid bit values that are not selected*/
79 	if (bf->value & ~bf->selector)
80 		return -EINVAL;
81 
82 	return 0;
83 }
84 
nla_validate_array(const struct nlattr * head,int len,int maxtype,const struct nla_policy * policy,struct netlink_ext_ack * extack,unsigned int validate,unsigned int depth)85 static int nla_validate_array(const struct nlattr *head, int len, int maxtype,
86 			      const struct nla_policy *policy,
87 			      struct netlink_ext_ack *extack,
88 			      unsigned int validate, unsigned int depth)
89 {
90 	const struct nlattr *entry;
91 	int rem;
92 
93 	nla_for_each_attr(entry, head, len, rem) {
94 		int ret;
95 
96 		if (nla_len(entry) == 0)
97 			continue;
98 
99 		if (nla_len(entry) < NLA_HDRLEN) {
100 			NL_SET_ERR_MSG_ATTR_POL(extack, entry, policy,
101 						"Array element too short");
102 			return -ERANGE;
103 		}
104 
105 		ret = __nla_validate_parse(nla_data(entry), nla_len(entry),
106 					   maxtype, policy, validate, extack,
107 					   NULL, depth + 1);
108 		if (ret < 0)
109 			return ret;
110 	}
111 
112 	return 0;
113 }
114 
nla_get_range_unsigned(const struct nla_policy * pt,struct netlink_range_validation * range)115 void nla_get_range_unsigned(const struct nla_policy *pt,
116 			    struct netlink_range_validation *range)
117 {
118 	WARN_ON_ONCE(pt->validation_type != NLA_VALIDATE_RANGE_PTR &&
119 		     (pt->min < 0 || pt->max < 0));
120 
121 	range->min = 0;
122 
123 	switch (pt->type) {
124 	case NLA_U8:
125 		range->max = U8_MAX;
126 		break;
127 	case NLA_U16:
128 	case NLA_BINARY:
129 		range->max = U16_MAX;
130 		break;
131 	case NLA_U32:
132 		range->max = U32_MAX;
133 		break;
134 	case NLA_U64:
135 	case NLA_MSECS:
136 		range->max = U64_MAX;
137 		break;
138 	default:
139 		WARN_ON_ONCE(1);
140 		return;
141 	}
142 
143 	switch (pt->validation_type) {
144 	case NLA_VALIDATE_RANGE:
145 	case NLA_VALIDATE_RANGE_WARN_TOO_LONG:
146 		range->min = pt->min;
147 		range->max = pt->max;
148 		break;
149 	case NLA_VALIDATE_RANGE_PTR:
150 		*range = *pt->range;
151 		break;
152 	case NLA_VALIDATE_MIN:
153 		range->min = pt->min;
154 		break;
155 	case NLA_VALIDATE_MAX:
156 		range->max = pt->max;
157 		break;
158 	default:
159 		break;
160 	}
161 }
162 
nla_validate_range_unsigned(const struct nla_policy * pt,const struct nlattr * nla,struct netlink_ext_ack * extack,unsigned int validate)163 static int nla_validate_range_unsigned(const struct nla_policy *pt,
164 				       const struct nlattr *nla,
165 				       struct netlink_ext_ack *extack,
166 				       unsigned int validate)
167 {
168 	struct netlink_range_validation range;
169 	u64 value;
170 
171 	switch (pt->type) {
172 	case NLA_U8:
173 		value = nla_get_u8(nla);
174 		break;
175 	case NLA_U16:
176 		value = nla_get_u16(nla);
177 		break;
178 	case NLA_U32:
179 		value = nla_get_u32(nla);
180 		break;
181 	case NLA_U64:
182 	case NLA_MSECS:
183 		value = nla_get_u64(nla);
184 		break;
185 	case NLA_BINARY:
186 		value = nla_len(nla);
187 		break;
188 	default:
189 		return -EINVAL;
190 	}
191 
192 	nla_get_range_unsigned(pt, &range);
193 
194 	if (pt->validation_type == NLA_VALIDATE_RANGE_WARN_TOO_LONG &&
195 	    pt->type == NLA_BINARY && value > range.max) {
196 		pr_warn_ratelimited("netlink: '%s': attribute type %d has an invalid length.\n",
197 				    current->comm, pt->type);
198 		if (validate & NL_VALIDATE_STRICT_ATTRS) {
199 			NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
200 						"invalid attribute length");
201 			return -EINVAL;
202 		}
203 
204 		/* this assumes min <= max (don't validate against min) */
205 		return 0;
206 	}
207 
208 	if (value < range.min || value > range.max) {
209 		bool binary = pt->type == NLA_BINARY;
210 
211 		if (binary)
212 			NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
213 						"binary attribute size out of range");
214 		else
215 			NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
216 						"integer out of range");
217 
218 		return -ERANGE;
219 	}
220 
221 	return 0;
222 }
223 
nla_get_range_signed(const struct nla_policy * pt,struct netlink_range_validation_signed * range)224 void nla_get_range_signed(const struct nla_policy *pt,
225 			  struct netlink_range_validation_signed *range)
226 {
227 	switch (pt->type) {
228 	case NLA_S8:
229 		range->min = S8_MIN;
230 		range->max = S8_MAX;
231 		break;
232 	case NLA_S16:
233 		range->min = S16_MIN;
234 		range->max = S16_MAX;
235 		break;
236 	case NLA_S32:
237 		range->min = S32_MIN;
238 		range->max = S32_MAX;
239 		break;
240 	case NLA_S64:
241 		range->min = S64_MIN;
242 		range->max = S64_MAX;
243 		break;
244 	default:
245 		WARN_ON_ONCE(1);
246 		return;
247 	}
248 
249 	switch (pt->validation_type) {
250 	case NLA_VALIDATE_RANGE:
251 		range->min = pt->min;
252 		range->max = pt->max;
253 		break;
254 	case NLA_VALIDATE_RANGE_PTR:
255 		*range = *pt->range_signed;
256 		break;
257 	case NLA_VALIDATE_MIN:
258 		range->min = pt->min;
259 		break;
260 	case NLA_VALIDATE_MAX:
261 		range->max = pt->max;
262 		break;
263 	default:
264 		break;
265 	}
266 }
267 
nla_validate_int_range_signed(const struct nla_policy * pt,const struct nlattr * nla,struct netlink_ext_ack * extack)268 static int nla_validate_int_range_signed(const struct nla_policy *pt,
269 					 const struct nlattr *nla,
270 					 struct netlink_ext_ack *extack)
271 {
272 	struct netlink_range_validation_signed range;
273 	s64 value;
274 
275 	switch (pt->type) {
276 	case NLA_S8:
277 		value = nla_get_s8(nla);
278 		break;
279 	case NLA_S16:
280 		value = nla_get_s16(nla);
281 		break;
282 	case NLA_S32:
283 		value = nla_get_s32(nla);
284 		break;
285 	case NLA_S64:
286 		value = nla_get_s64(nla);
287 		break;
288 	default:
289 		return -EINVAL;
290 	}
291 
292 	nla_get_range_signed(pt, &range);
293 
294 	if (value < range.min || value > range.max) {
295 		NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
296 					"integer out of range");
297 		return -ERANGE;
298 	}
299 
300 	return 0;
301 }
302 
nla_validate_int_range(const struct nla_policy * pt,const struct nlattr * nla,struct netlink_ext_ack * extack,unsigned int validate)303 static int nla_validate_int_range(const struct nla_policy *pt,
304 				  const struct nlattr *nla,
305 				  struct netlink_ext_ack *extack,
306 				  unsigned int validate)
307 {
308 	switch (pt->type) {
309 	case NLA_U8:
310 	case NLA_U16:
311 	case NLA_U32:
312 	case NLA_U64:
313 	case NLA_MSECS:
314 	case NLA_BINARY:
315 		return nla_validate_range_unsigned(pt, nla, extack, validate);
316 	case NLA_S8:
317 	case NLA_S16:
318 	case NLA_S32:
319 	case NLA_S64:
320 		return nla_validate_int_range_signed(pt, nla, extack);
321 	default:
322 		WARN_ON(1);
323 		return -EINVAL;
324 	}
325 }
326 
nla_validate_mask(const struct nla_policy * pt,const struct nlattr * nla,struct netlink_ext_ack * extack)327 static int nla_validate_mask(const struct nla_policy *pt,
328 			     const struct nlattr *nla,
329 			     struct netlink_ext_ack *extack)
330 {
331 	u64 value;
332 
333 	switch (pt->type) {
334 	case NLA_U8:
335 		value = nla_get_u8(nla);
336 		break;
337 	case NLA_U16:
338 		value = nla_get_u16(nla);
339 		break;
340 	case NLA_U32:
341 		value = nla_get_u32(nla);
342 		break;
343 	case NLA_U64:
344 		value = nla_get_u64(nla);
345 		break;
346 	default:
347 		return -EINVAL;
348 	}
349 
350 	if (value & ~(u64)pt->mask) {
351 		NL_SET_ERR_MSG_ATTR(extack, nla, "reserved bit set");
352 		return -EINVAL;
353 	}
354 
355 	return 0;
356 }
357 
validate_nla(const struct nlattr * nla,int maxtype,const struct nla_policy * policy,unsigned int validate,struct netlink_ext_ack * extack,unsigned int depth)358 static int validate_nla(const struct nlattr *nla, int maxtype,
359 			const struct nla_policy *policy, unsigned int validate,
360 			struct netlink_ext_ack *extack, unsigned int depth)
361 {
362 	u16 strict_start_type = policy[0].strict_start_type;
363 	const struct nla_policy *pt;
364 	int minlen = 0, attrlen = nla_len(nla), type = nla_type(nla);
365 	int err = -ERANGE;
366 
367 	if (strict_start_type && type >= strict_start_type)
368 		validate |= NL_VALIDATE_STRICT;
369 
370 	if (type <= 0 || type > maxtype)
371 		return 0;
372 
373 	type = array_index_nospec(type, maxtype + 1);
374 	pt = &policy[type];
375 
376 	BUG_ON(pt->type > NLA_TYPE_MAX);
377 
378 	if (nla_attr_len[pt->type] && attrlen != nla_attr_len[pt->type]) {
379 		pr_warn_ratelimited("netlink: '%s': attribute type %d has an invalid length.\n",
380 				    current->comm, type);
381 		if (validate & NL_VALIDATE_STRICT_ATTRS) {
382 			NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
383 						"invalid attribute length");
384 			return -EINVAL;
385 		}
386 	}
387 
388 	if (validate & NL_VALIDATE_NESTED) {
389 		if ((pt->type == NLA_NESTED || pt->type == NLA_NESTED_ARRAY) &&
390 		    !(nla->nla_type & NLA_F_NESTED)) {
391 			NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
392 						"NLA_F_NESTED is missing");
393 			return -EINVAL;
394 		}
395 		if (pt->type != NLA_NESTED && pt->type != NLA_NESTED_ARRAY &&
396 		    pt->type != NLA_UNSPEC && (nla->nla_type & NLA_F_NESTED)) {
397 			NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
398 						"NLA_F_NESTED not expected");
399 			return -EINVAL;
400 		}
401 	}
402 
403 	switch (pt->type) {
404 	case NLA_REJECT:
405 		if (extack && pt->reject_message) {
406 			NL_SET_BAD_ATTR(extack, nla);
407 			extack->_msg = pt->reject_message;
408 			return -EINVAL;
409 		}
410 		err = -EINVAL;
411 		goto out_err;
412 
413 	case NLA_FLAG:
414 		if (attrlen > 0)
415 			goto out_err;
416 		break;
417 
418 	case NLA_BITFIELD32:
419 		if (attrlen != sizeof(struct nla_bitfield32))
420 			goto out_err;
421 
422 		err = validate_nla_bitfield32(nla, pt->bitfield32_valid);
423 		if (err)
424 			goto out_err;
425 		break;
426 
427 	case NLA_NUL_STRING:
428 		if (pt->len)
429 			minlen = min_t(int, attrlen, pt->len + 1);
430 		else
431 			minlen = attrlen;
432 
433 		if (!minlen || memchr(nla_data(nla), '\0', minlen) == NULL) {
434 			err = -EINVAL;
435 			goto out_err;
436 		}
437 		/* fall through */
438 
439 	case NLA_STRING:
440 		if (attrlen < 1)
441 			goto out_err;
442 
443 		if (pt->len) {
444 			char *buf = nla_data(nla);
445 
446 			if (buf[attrlen - 1] == '\0')
447 				attrlen--;
448 
449 			if (attrlen > pt->len)
450 				goto out_err;
451 		}
452 		break;
453 
454 	case NLA_BINARY:
455 		if (pt->len && attrlen > pt->len)
456 			goto out_err;
457 		break;
458 
459 	case NLA_NESTED:
460 		/* a nested attributes is allowed to be empty; if its not,
461 		 * it must have a size of at least NLA_HDRLEN.
462 		 */
463 		if (attrlen == 0)
464 			break;
465 		if (attrlen < NLA_HDRLEN)
466 			goto out_err;
467 		if (pt->nested_policy) {
468 			err = __nla_validate_parse(nla_data(nla), nla_len(nla),
469 						   pt->len, pt->nested_policy,
470 						   validate, extack, NULL,
471 						   depth + 1);
472 			if (err < 0) {
473 				/*
474 				 * return directly to preserve the inner
475 				 * error message/attribute pointer
476 				 */
477 				return err;
478 			}
479 		}
480 		break;
481 	case NLA_NESTED_ARRAY:
482 		/* a nested array attribute is allowed to be empty; if its not,
483 		 * it must have a size of at least NLA_HDRLEN.
484 		 */
485 		if (attrlen == 0)
486 			break;
487 		if (attrlen < NLA_HDRLEN)
488 			goto out_err;
489 		if (pt->nested_policy) {
490 			int err;
491 
492 			err = nla_validate_array(nla_data(nla), nla_len(nla),
493 						 pt->len, pt->nested_policy,
494 						 extack, validate, depth);
495 			if (err < 0) {
496 				/*
497 				 * return directly to preserve the inner
498 				 * error message/attribute pointer
499 				 */
500 				return err;
501 			}
502 		}
503 		break;
504 
505 	case NLA_UNSPEC:
506 		if (validate & NL_VALIDATE_UNSPEC) {
507 			NL_SET_ERR_MSG_ATTR(extack, nla,
508 					    "Unsupported attribute");
509 			return -EINVAL;
510 		}
511 		if (attrlen < pt->len)
512 			goto out_err;
513 		break;
514 
515 	default:
516 		if (pt->len)
517 			minlen = pt->len;
518 		else
519 			minlen = nla_attr_minlen[pt->type];
520 
521 		if (attrlen < minlen)
522 			goto out_err;
523 	}
524 
525 	/* further validation */
526 	switch (pt->validation_type) {
527 	case NLA_VALIDATE_NONE:
528 		/* nothing to do */
529 		break;
530 	case NLA_VALIDATE_RANGE_PTR:
531 	case NLA_VALIDATE_RANGE:
532 	case NLA_VALIDATE_RANGE_WARN_TOO_LONG:
533 	case NLA_VALIDATE_MIN:
534 	case NLA_VALIDATE_MAX:
535 		err = nla_validate_int_range(pt, nla, extack, validate);
536 		if (err)
537 			return err;
538 		break;
539 	case NLA_VALIDATE_MASK:
540 		err = nla_validate_mask(pt, nla, extack);
541 		if (err)
542 			return err;
543 		break;
544 	case NLA_VALIDATE_FUNCTION:
545 		if (pt->validate) {
546 			err = pt->validate(nla, extack);
547 			if (err)
548 				return err;
549 		}
550 		break;
551 	}
552 
553 	return 0;
554 out_err:
555 	NL_SET_ERR_MSG_ATTR_POL(extack, nla, pt,
556 				"Attribute failed policy validation");
557 	return err;
558 }
559 
__nla_validate_parse(const struct nlattr * head,int len,int maxtype,const struct nla_policy * policy,unsigned int validate,struct netlink_ext_ack * extack,struct nlattr ** tb,unsigned int depth)560 static int __nla_validate_parse(const struct nlattr *head, int len, int maxtype,
561 				const struct nla_policy *policy,
562 				unsigned int validate,
563 				struct netlink_ext_ack *extack,
564 				struct nlattr **tb, unsigned int depth)
565 {
566 	const struct nlattr *nla;
567 	int rem;
568 
569 	if (depth >= MAX_POLICY_RECURSION_DEPTH) {
570 		NL_SET_ERR_MSG(extack,
571 			       "allowed policy recursion depth exceeded");
572 		return -EINVAL;
573 	}
574 
575 	if (tb)
576 		memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
577 
578 	nla_for_each_attr(nla, head, len, rem) {
579 		u16 type = nla_type(nla);
580 
581 		if (type == 0 || type > maxtype) {
582 			if (validate & NL_VALIDATE_MAXTYPE) {
583 				NL_SET_ERR_MSG_ATTR(extack, nla,
584 						    "Unknown attribute type");
585 				return -EINVAL;
586 			}
587 			continue;
588 		}
589 		type = array_index_nospec(type, maxtype + 1);
590 		if (policy) {
591 			int err = validate_nla(nla, maxtype, policy,
592 					       validate, extack, depth);
593 
594 			if (err < 0)
595 				return err;
596 		}
597 
598 		if (tb)
599 			tb[type] = (struct nlattr *)nla;
600 	}
601 
602 	if (unlikely(rem > 0)) {
603 		pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
604 				    rem, current->comm);
605 		NL_SET_ERR_MSG(extack, "bytes leftover after parsing attributes");
606 		if (validate & NL_VALIDATE_TRAILING)
607 			return -EINVAL;
608 	}
609 
610 	return 0;
611 }
612 
613 /**
614  * __nla_validate - Validate a stream of attributes
615  * @head: head of attribute stream
616  * @len: length of attribute stream
617  * @maxtype: maximum attribute type to be expected
618  * @policy: validation policy
619  * @validate: validation strictness
620  * @extack: extended ACK report struct
621  *
622  * Validates all attributes in the specified attribute stream against the
623  * specified policy. Validation depends on the validate flags passed, see
624  * &enum netlink_validation for more details on that.
625  * See documenation of struct nla_policy for more details.
626  *
627  * Returns 0 on success or a negative error code.
628  */
__nla_validate(const struct nlattr * head,int len,int maxtype,const struct nla_policy * policy,unsigned int validate,struct netlink_ext_ack * extack)629 int __nla_validate(const struct nlattr *head, int len, int maxtype,
630 		   const struct nla_policy *policy, unsigned int validate,
631 		   struct netlink_ext_ack *extack)
632 {
633 	return __nla_validate_parse(head, len, maxtype, policy, validate,
634 				    extack, NULL, 0);
635 }
636 EXPORT_SYMBOL(__nla_validate);
637 
638 /**
639  * nla_policy_len - Determin the max. length of a policy
640  * @policy: policy to use
641  * @n: number of policies
642  *
643  * Determines the max. length of the policy.  It is currently used
644  * to allocated Netlink buffers roughly the size of the actual
645  * message.
646  *
647  * Returns 0 on success or a negative error code.
648  */
649 int
nla_policy_len(const struct nla_policy * p,int n)650 nla_policy_len(const struct nla_policy *p, int n)
651 {
652 	int i, len = 0;
653 
654 	for (i = 0; i < n; i++, p++) {
655 		if (p->len)
656 			len += nla_total_size(p->len);
657 		else if (nla_attr_len[p->type])
658 			len += nla_total_size(nla_attr_len[p->type]);
659 		else if (nla_attr_minlen[p->type])
660 			len += nla_total_size(nla_attr_minlen[p->type]);
661 	}
662 
663 	return len;
664 }
665 EXPORT_SYMBOL(nla_policy_len);
666 
667 /**
668  * __nla_parse - Parse a stream of attributes into a tb buffer
669  * @tb: destination array with maxtype+1 elements
670  * @maxtype: maximum attribute type to be expected
671  * @head: head of attribute stream
672  * @len: length of attribute stream
673  * @policy: validation policy
674  * @validate: validation strictness
675  * @extack: extended ACK pointer
676  *
677  * Parses a stream of attributes and stores a pointer to each attribute in
678  * the tb array accessible via the attribute type.
679  * Validation is controlled by the @validate parameter.
680  *
681  * Returns 0 on success or a negative error code.
682  */
__nla_parse(struct nlattr ** tb,int maxtype,const struct nlattr * head,int len,const struct nla_policy * policy,unsigned int validate,struct netlink_ext_ack * extack)683 int __nla_parse(struct nlattr **tb, int maxtype,
684 		const struct nlattr *head, int len,
685 		const struct nla_policy *policy, unsigned int validate,
686 		struct netlink_ext_ack *extack)
687 {
688 	return __nla_validate_parse(head, len, maxtype, policy, validate,
689 				    extack, tb, 0);
690 }
691 EXPORT_SYMBOL(__nla_parse);
692 
693 /**
694  * nla_find - Find a specific attribute in a stream of attributes
695  * @head: head of attribute stream
696  * @len: length of attribute stream
697  * @attrtype: type of attribute to look for
698  *
699  * Returns the first attribute in the stream matching the specified type.
700  */
nla_find(const struct nlattr * head,int len,int attrtype)701 struct nlattr *nla_find(const struct nlattr *head, int len, int attrtype)
702 {
703 	const struct nlattr *nla;
704 	int rem;
705 
706 	nla_for_each_attr(nla, head, len, rem)
707 		if (nla_type(nla) == attrtype)
708 			return (struct nlattr *)nla;
709 
710 	return NULL;
711 }
712 EXPORT_SYMBOL(nla_find);
713 
714 /**
715  * nla_strlcpy - Copy string attribute payload into a sized buffer
716  * @dst: where to copy the string to
717  * @nla: attribute to copy the string from
718  * @dstsize: size of destination buffer
719  *
720  * Copies at most dstsize - 1 bytes into the destination buffer.
721  * The result is always a valid NUL-terminated string. Unlike
722  * strlcpy the destination buffer is always padded out.
723  *
724  * Returns the length of the source buffer.
725  */
nla_strlcpy(char * dst,const struct nlattr * nla,size_t dstsize)726 size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
727 {
728 	size_t srclen = nla_len(nla);
729 	char *src = nla_data(nla);
730 
731 	if (srclen > 0 && src[srclen - 1] == '\0')
732 		srclen--;
733 
734 	if (dstsize > 0) {
735 		size_t len = (srclen >= dstsize) ? dstsize - 1 : srclen;
736 
737 		memset(dst, 0, dstsize);
738 		memcpy(dst, src, len);
739 	}
740 
741 	return srclen;
742 }
743 EXPORT_SYMBOL(nla_strlcpy);
744 
745 /**
746  * nla_strdup - Copy string attribute payload into a newly allocated buffer
747  * @nla: attribute to copy the string from
748  * @flags: the type of memory to allocate (see kmalloc).
749  *
750  * Returns a pointer to the allocated buffer or NULL on error.
751  */
nla_strdup(const struct nlattr * nla,gfp_t flags)752 char *nla_strdup(const struct nlattr *nla, gfp_t flags)
753 {
754 	size_t srclen = nla_len(nla);
755 	char *src = nla_data(nla), *dst;
756 
757 	if (srclen > 0 && src[srclen - 1] == '\0')
758 		srclen--;
759 
760 	dst = kmalloc(srclen + 1, flags);
761 	if (dst != NULL) {
762 		memcpy(dst, src, srclen);
763 		dst[srclen] = '\0';
764 	}
765 	return dst;
766 }
767 EXPORT_SYMBOL(nla_strdup);
768 
769 /**
770  * nla_memcpy - Copy a netlink attribute into another memory area
771  * @dest: where to copy to memcpy
772  * @src: netlink attribute to copy from
773  * @count: size of the destination area
774  *
775  * Note: The number of bytes copied is limited by the length of
776  *       attribute's payload. memcpy
777  *
778  * Returns the number of bytes copied.
779  */
nla_memcpy(void * dest,const struct nlattr * src,int count)780 int nla_memcpy(void *dest, const struct nlattr *src, int count)
781 {
782 	int minlen = min_t(int, count, nla_len(src));
783 
784 	memcpy(dest, nla_data(src), minlen);
785 	if (count > minlen)
786 		memset(dest + minlen, 0, count - minlen);
787 
788 	return minlen;
789 }
790 EXPORT_SYMBOL(nla_memcpy);
791 
792 /**
793  * nla_memcmp - Compare an attribute with sized memory area
794  * @nla: netlink attribute
795  * @data: memory area
796  * @size: size of memory area
797  */
nla_memcmp(const struct nlattr * nla,const void * data,size_t size)798 int nla_memcmp(const struct nlattr *nla, const void *data,
799 			     size_t size)
800 {
801 	int d = nla_len(nla) - size;
802 
803 	if (d == 0)
804 		d = memcmp(nla_data(nla), data, size);
805 
806 	return d;
807 }
808 EXPORT_SYMBOL(nla_memcmp);
809 
810 /**
811  * nla_strcmp - Compare a string attribute against a string
812  * @nla: netlink string attribute
813  * @str: another string
814  */
nla_strcmp(const struct nlattr * nla,const char * str)815 int nla_strcmp(const struct nlattr *nla, const char *str)
816 {
817 	int len = strlen(str);
818 	char *buf = nla_data(nla);
819 	int attrlen = nla_len(nla);
820 	int d;
821 
822 	while (attrlen > 0 && buf[attrlen - 1] == '\0')
823 		attrlen--;
824 
825 	d = attrlen - len;
826 	if (d == 0)
827 		d = memcmp(nla_data(nla), str, len);
828 
829 	return d;
830 }
831 EXPORT_SYMBOL(nla_strcmp);
832 
833 #ifdef CONFIG_NET
834 /**
835  * __nla_reserve - reserve room for attribute on the skb
836  * @skb: socket buffer to reserve room on
837  * @attrtype: attribute type
838  * @attrlen: length of attribute payload
839  *
840  * Adds a netlink attribute header to a socket buffer and reserves
841  * room for the payload but does not copy it.
842  *
843  * The caller is responsible to ensure that the skb provides enough
844  * tailroom for the attribute header and payload.
845  */
__nla_reserve(struct sk_buff * skb,int attrtype,int attrlen)846 struct nlattr *__nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
847 {
848 	struct nlattr *nla;
849 
850 	nla = skb_put(skb, nla_total_size(attrlen));
851 	nla->nla_type = attrtype;
852 	nla->nla_len = nla_attr_size(attrlen);
853 
854 	memset((unsigned char *) nla + nla->nla_len, 0, nla_padlen(attrlen));
855 
856 	return nla;
857 }
858 EXPORT_SYMBOL(__nla_reserve);
859 
860 /**
861  * __nla_reserve_64bit - reserve room for attribute on the skb and align it
862  * @skb: socket buffer to reserve room on
863  * @attrtype: attribute type
864  * @attrlen: length of attribute payload
865  * @padattr: attribute type for the padding
866  *
867  * Adds a netlink attribute header to a socket buffer and reserves
868  * room for the payload but does not copy it. It also ensure that this
869  * attribute will have a 64-bit aligned nla_data() area.
870  *
871  * The caller is responsible to ensure that the skb provides enough
872  * tailroom for the attribute header and payload.
873  */
__nla_reserve_64bit(struct sk_buff * skb,int attrtype,int attrlen,int padattr)874 struct nlattr *__nla_reserve_64bit(struct sk_buff *skb, int attrtype,
875 				   int attrlen, int padattr)
876 {
877 	nla_align_64bit(skb, padattr);
878 
879 	return __nla_reserve(skb, attrtype, attrlen);
880 }
881 EXPORT_SYMBOL(__nla_reserve_64bit);
882 
883 /**
884  * __nla_reserve_nohdr - reserve room for attribute without header
885  * @skb: socket buffer to reserve room on
886  * @attrlen: length of attribute payload
887  *
888  * Reserves room for attribute payload without a header.
889  *
890  * The caller is responsible to ensure that the skb provides enough
891  * tailroom for the payload.
892  */
__nla_reserve_nohdr(struct sk_buff * skb,int attrlen)893 void *__nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
894 {
895 	return skb_put_zero(skb, NLA_ALIGN(attrlen));
896 }
897 EXPORT_SYMBOL(__nla_reserve_nohdr);
898 
899 /**
900  * nla_reserve - reserve room for attribute on the skb
901  * @skb: socket buffer to reserve room on
902  * @attrtype: attribute type
903  * @attrlen: length of attribute payload
904  *
905  * Adds a netlink attribute header to a socket buffer and reserves
906  * room for the payload but does not copy it.
907  *
908  * Returns NULL if the tailroom of the skb is insufficient to store
909  * the attribute header and payload.
910  */
nla_reserve(struct sk_buff * skb,int attrtype,int attrlen)911 struct nlattr *nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
912 {
913 	if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
914 		return NULL;
915 
916 	return __nla_reserve(skb, attrtype, attrlen);
917 }
918 EXPORT_SYMBOL(nla_reserve);
919 
920 /**
921  * nla_reserve_64bit - reserve room for attribute on the skb and align it
922  * @skb: socket buffer to reserve room on
923  * @attrtype: attribute type
924  * @attrlen: length of attribute payload
925  * @padattr: attribute type for the padding
926  *
927  * Adds a netlink attribute header to a socket buffer and reserves
928  * room for the payload but does not copy it. It also ensure that this
929  * attribute will have a 64-bit aligned nla_data() area.
930  *
931  * Returns NULL if the tailroom of the skb is insufficient to store
932  * the attribute header and payload.
933  */
nla_reserve_64bit(struct sk_buff * skb,int attrtype,int attrlen,int padattr)934 struct nlattr *nla_reserve_64bit(struct sk_buff *skb, int attrtype, int attrlen,
935 				 int padattr)
936 {
937 	size_t len;
938 
939 	if (nla_need_padding_for_64bit(skb))
940 		len = nla_total_size_64bit(attrlen);
941 	else
942 		len = nla_total_size(attrlen);
943 	if (unlikely(skb_tailroom(skb) < len))
944 		return NULL;
945 
946 	return __nla_reserve_64bit(skb, attrtype, attrlen, padattr);
947 }
948 EXPORT_SYMBOL(nla_reserve_64bit);
949 
950 /**
951  * nla_reserve_nohdr - reserve room for attribute without header
952  * @skb: socket buffer to reserve room on
953  * @attrlen: length of attribute payload
954  *
955  * Reserves room for attribute payload without a header.
956  *
957  * Returns NULL if the tailroom of the skb is insufficient to store
958  * the attribute payload.
959  */
nla_reserve_nohdr(struct sk_buff * skb,int attrlen)960 void *nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
961 {
962 	if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
963 		return NULL;
964 
965 	return __nla_reserve_nohdr(skb, attrlen);
966 }
967 EXPORT_SYMBOL(nla_reserve_nohdr);
968 
969 /**
970  * __nla_put - Add a netlink attribute to a socket buffer
971  * @skb: socket buffer to add attribute to
972  * @attrtype: attribute type
973  * @attrlen: length of attribute payload
974  * @data: head of attribute payload
975  *
976  * The caller is responsible to ensure that the skb provides enough
977  * tailroom for the attribute header and payload.
978  */
__nla_put(struct sk_buff * skb,int attrtype,int attrlen,const void * data)979 void __nla_put(struct sk_buff *skb, int attrtype, int attrlen,
980 			     const void *data)
981 {
982 	struct nlattr *nla;
983 
984 	nla = __nla_reserve(skb, attrtype, attrlen);
985 	memcpy(nla_data(nla), data, attrlen);
986 }
987 EXPORT_SYMBOL(__nla_put);
988 
989 /**
990  * __nla_put_64bit - Add a netlink attribute to a socket buffer and align it
991  * @skb: socket buffer to add attribute to
992  * @attrtype: attribute type
993  * @attrlen: length of attribute payload
994  * @data: head of attribute payload
995  * @padattr: attribute type for the padding
996  *
997  * The caller is responsible to ensure that the skb provides enough
998  * tailroom for the attribute header and payload.
999  */
__nla_put_64bit(struct sk_buff * skb,int attrtype,int attrlen,const void * data,int padattr)1000 void __nla_put_64bit(struct sk_buff *skb, int attrtype, int attrlen,
1001 		     const void *data, int padattr)
1002 {
1003 	struct nlattr *nla;
1004 
1005 	nla = __nla_reserve_64bit(skb, attrtype, attrlen, padattr);
1006 	memcpy(nla_data(nla), data, attrlen);
1007 }
1008 EXPORT_SYMBOL(__nla_put_64bit);
1009 
1010 /**
1011  * __nla_put_nohdr - Add a netlink attribute without header
1012  * @skb: socket buffer to add attribute to
1013  * @attrlen: length of attribute payload
1014  * @data: head of attribute payload
1015  *
1016  * The caller is responsible to ensure that the skb provides enough
1017  * tailroom for the attribute payload.
1018  */
__nla_put_nohdr(struct sk_buff * skb,int attrlen,const void * data)1019 void __nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
1020 {
1021 	void *start;
1022 
1023 	start = __nla_reserve_nohdr(skb, attrlen);
1024 	memcpy(start, data, attrlen);
1025 }
1026 EXPORT_SYMBOL(__nla_put_nohdr);
1027 
1028 /**
1029  * nla_put - Add a netlink attribute to a socket buffer
1030  * @skb: socket buffer to add attribute to
1031  * @attrtype: attribute type
1032  * @attrlen: length of attribute payload
1033  * @data: head of attribute payload
1034  *
1035  * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
1036  * the attribute header and payload.
1037  */
nla_put(struct sk_buff * skb,int attrtype,int attrlen,const void * data)1038 int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
1039 {
1040 	if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
1041 		return -EMSGSIZE;
1042 
1043 	__nla_put(skb, attrtype, attrlen, data);
1044 	return 0;
1045 }
1046 EXPORT_SYMBOL(nla_put);
1047 
1048 /**
1049  * nla_put_64bit - Add a netlink attribute to a socket buffer and align it
1050  * @skb: socket buffer to add attribute to
1051  * @attrtype: attribute type
1052  * @attrlen: length of attribute payload
1053  * @data: head of attribute payload
1054  * @padattr: attribute type for the padding
1055  *
1056  * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
1057  * the attribute header and payload.
1058  */
nla_put_64bit(struct sk_buff * skb,int attrtype,int attrlen,const void * data,int padattr)1059 int nla_put_64bit(struct sk_buff *skb, int attrtype, int attrlen,
1060 		  const void *data, int padattr)
1061 {
1062 	size_t len;
1063 
1064 	if (nla_need_padding_for_64bit(skb))
1065 		len = nla_total_size_64bit(attrlen);
1066 	else
1067 		len = nla_total_size(attrlen);
1068 	if (unlikely(skb_tailroom(skb) < len))
1069 		return -EMSGSIZE;
1070 
1071 	__nla_put_64bit(skb, attrtype, attrlen, data, padattr);
1072 	return 0;
1073 }
1074 EXPORT_SYMBOL(nla_put_64bit);
1075 
1076 /**
1077  * nla_put_nohdr - Add a netlink attribute without header
1078  * @skb: socket buffer to add attribute to
1079  * @attrlen: length of attribute payload
1080  * @data: head of attribute payload
1081  *
1082  * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
1083  * the attribute payload.
1084  */
nla_put_nohdr(struct sk_buff * skb,int attrlen,const void * data)1085 int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
1086 {
1087 	if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
1088 		return -EMSGSIZE;
1089 
1090 	__nla_put_nohdr(skb, attrlen, data);
1091 	return 0;
1092 }
1093 EXPORT_SYMBOL(nla_put_nohdr);
1094 
1095 /**
1096  * nla_append - Add a netlink attribute without header or padding
1097  * @skb: socket buffer to add attribute to
1098  * @attrlen: length of attribute payload
1099  * @data: head of attribute payload
1100  *
1101  * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
1102  * the attribute payload.
1103  */
nla_append(struct sk_buff * skb,int attrlen,const void * data)1104 int nla_append(struct sk_buff *skb, int attrlen, const void *data)
1105 {
1106 	if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
1107 		return -EMSGSIZE;
1108 
1109 	skb_put_data(skb, data, attrlen);
1110 	return 0;
1111 }
1112 EXPORT_SYMBOL(nla_append);
1113 #endif
1114