netlink: Always copy on mmap TX.
authorDavid Miller <davem@davemloft.net>
Tue, 16 Dec 2014 22:58:17 +0000 (17:58 -0500)
committerDanny Wood <danwood76@gmail.com>
Tue, 29 Jan 2019 13:05:54 +0000 (13:05 +0000)
commit81356b5f06c8bad6b63636376fb9e5dadd6637a6
treebec984858fd367bd76e2ad888d2e41d61a134039
parent50b31027704785db3da0d32678579cf795d18ff2
netlink: Always copy on mmap TX.

[ Upstream commit 4682a0358639b29cf69437ed909c6221f8c89847 ]

Checking the file f_count and the nlk->mapped count is not completely
sufficient to prevent the mmap'd area contents from changing from
under us during netlink mmap sendmsg() operations.

Be careful to sample the header's length field only once, because this
could change from under us as well.

Fixes: 5fd96123ee19 ("netlink: implement memory mapped sendmsg()")
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/netlink/af_netlink.c