3 files changed, 216 insertions, 42 deletions

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8b85036ba8e3..d56e0d21f919 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1147,7 +1147,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (len > sk->sk_sndbuf - 32)
                 goto out;
         err = -ENOBUFS;
-        skb = alloc_skb(len, GFP_KERNEL);
+        skb = nlmsg_new(len, GFP_KERNEL);
         if (skb==NULL)
                 goto out;
 
@@ -1341,19 +1341,18 @@ static int netlink_dump(struct sock *sk)
         struct netlink_callback *cb;
         struct sk_buff *skb;
         struct nlmsghdr *nlh;
-        int len;
+        int len, err = -ENOBUFS;
         
         skb = sock_rmalloc(sk, NLMSG_GOODSIZE, 0, GFP_KERNEL);
         if (!skb)
-                return -ENOBUFS;
+                goto errout;
 
         spin_lock(&nlk->cb_lock);
 
         cb = nlk->cb;
         if (cb == NULL) {
-                spin_unlock(&nlk->cb_lock);
-                kfree_skb(skb);
-                return -EINVAL;
+                err = -EINVAL;
+                goto errout_skb;
         }
 
         len = cb->dump(skb, cb);
@@ -1365,8 +1364,12 @@ static int netlink_dump(struct sock *sk)
                 return 0;
         }
 
-        nlh = NLMSG_NEW_ANSWER(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
-        memcpy(NLMSG_DATA(nlh), &len, sizeof(len));
+        nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
+        if (!nlh)
+                goto errout_skb;
+
+        memcpy(nlmsg_data(nlh), &len, sizeof(len));
+
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, skb->len);
 
@@ -1378,8 +1381,11 @@ static int netlink_dump(struct sock *sk)
         netlink_destroy_callback(cb);
         return 0;
 
-nlmsg_failure:
-        return -ENOBUFS;
+errout_skb:
+        spin_unlock(&nlk->cb_lock);
+        kfree_skb(skb);
+errout:
+        return err;
 }
 
 int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
@@ -1431,11 +1437,11 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
         int size;
 
         if (err == 0)
-                size = NLMSG_SPACE(sizeof(struct nlmsgerr));
+                size = nlmsg_total_size(sizeof(*errmsg));
         else
-                size = NLMSG_SPACE(4 + NLMSG_ALIGN(nlh->nlmsg_len));
+                size = nlmsg_total_size(sizeof(*errmsg) + nlmsg_len(nlh));
 
-        skb = alloc_skb(size, GFP_KERNEL);
+        skb = nlmsg_new(size, GFP_KERNEL);
         if (!skb) {
                 struct sock *sk;
 
@@ -1451,16 +1457,15 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
 
         rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
                           NLMSG_ERROR, sizeof(struct nlmsgerr), 0);
-        errmsg = NLMSG_DATA(rep);
+        errmsg = nlmsg_data(rep);
         errmsg->error = err;
-        memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(struct nlmsghdr));
+        memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh));
         netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).pid, MSG_DONTWAIT);
 }
 
 static int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
                                                      struct nlmsghdr *, int *))
 {
-        unsigned int total_len;
         struct nlmsghdr *nlh;
         int err;
 
@@ -1470,8 +1475,6 @@ static int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
                 if (nlh->nlmsg_len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len)
                         return 0;
 
-                total_len = min(NLMSG_ALIGN(nlh->nlmsg_len), skb->len);
-
                 if (cb(skb, nlh, &err) < 0) {
                         /* Not an error, but we have to interrupt processing
                          * here. Note: that in this case we do not pull
@@ -1483,7 +1486,7 @@ static int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
                 } else if (nlh->nlmsg_flags & NLM_F_ACK)
                         netlink_ack(skb, nlh, 0);
 
-                skb_pull(skb, total_len);
+                netlink_queue_skip(nlh, skb);
         }
 
         return 0;
@@ -1546,6 +1549,38 @@ void netlink_queue_skip(struct nlmsghdr *nlh, struct sk_buff *skb)
         skb_pull(skb, msglen);
 }
 
+/**
+ * nlmsg_notify - send a notification netlink message
+ * @sk: netlink socket to use
+ * @skb: notification message
+ * @pid: destination netlink pid for reports or 0
+ * @group: destination multicast group or 0
+ * @report: 1 to report back, 0 to disable
+ * @flags: allocation flags
+ */
+int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 pid,
+                 unsigned int group, int report, gfp_t flags)
+{
+        int err = 0;
+
+        if (group) {
+                int exclude_pid = 0;
+
+                if (report) {
+                        atomic_inc(&skb->users);
+                        exclude_pid = pid;
+                }
+
+                /* errors reported via destination sk->sk_err */
+                nlmsg_multicast(sk, skb, exclude_pid, group, flags);
+        }
+
+        if (report)
+                err = nlmsg_unicast(sk, skb, pid);
+
+        return err;
+}
+
 #ifdef CONFIG_PROC_FS
 struct nl_seq_iter {
         int link;
@@ -1727,8 +1762,6 @@ static struct net_proto_family netlink_family_ops = {
         .owner  = THIS_MODULE,  /* for consistency 8) */
 };
 
-extern void netlink_skb_parms_too_large(void);
-
 static int __init netlink_proto_init(void)
 {
         struct sk_buff *dummy_skb;
@@ -1740,8 +1773,7 @@ static int __init netlink_proto_init(void)
         if (err != 0)
                 goto out;
 
-        if (sizeof(struct netlink_skb_parms) > sizeof(dummy_skb->cb))
-                netlink_skb_parms_too_large();
+        BUILD_BUG_ON(sizeof(struct netlink_skb_parms) > sizeof(dummy_skb->cb));
 
         nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
         if (!nl_table)
@@ -1799,4 +1831,4 @@ EXPORT_SYMBOL(netlink_set_err);
 EXPORT_SYMBOL(netlink_set_nonroot);
 EXPORT_SYMBOL(netlink_unicast);
 EXPORT_SYMBOL(netlink_unregister_notifier);
-
+EXPORT_SYMBOL(nlmsg_notify);
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index dddbd15135a8..004139557e09 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -20,7 +20,6 @@ static u16 nla_attr_minlen[NLA_TYPE_MAX+1] __read_mostly = {
         [NLA_U16]       = sizeof(u16),
         [NLA_U32]       = sizeof(u32),
         [NLA_U64]       = sizeof(u64),
-        [NLA_STRING]    = 1,
         [NLA_NESTED]    = NLA_HDRLEN,
 };
 
@@ -28,7 +27,7 @@ static int validate_nla(struct nlattr *nla, int maxtype,
                         struct nla_policy *policy)
 {
         struct nla_policy *pt;
-        int minlen = 0;
+        int minlen = 0, attrlen = nla_len(nla);
 
         if (nla->nla_type <= 0 || nla->nla_type > maxtype)
                 return 0;
@@ -37,16 +36,46 @@ static int validate_nla(struct nlattr *nla, int maxtype,
 
         BUG_ON(pt->type > NLA_TYPE_MAX);
 
-        if (pt->minlen)
-                minlen = pt->minlen;
-        else if (pt->type != NLA_UNSPEC)
-                minlen = nla_attr_minlen[pt->type];
+        switch (pt->type) {
+        case NLA_FLAG:
+                if (attrlen > 0)
+                        return -ERANGE;
+                break;
 
-        if (pt->type == NLA_FLAG && nla_len(nla) > 0)
-                return -ERANGE;
+        case NLA_NUL_STRING:
+                if (pt->len)
+                        minlen = min_t(int, attrlen, pt->len + 1);
+                else
+                        minlen = attrlen;
 
-        if (nla_len(nla) < minlen)
-                return -ERANGE;
+                if (!minlen || memchr(nla_data(nla), '\0', minlen) == NULL)
+                        return -EINVAL;
+                /* fall through */
+
+        case NLA_STRING:
+                if (attrlen < 1)
+                        return -ERANGE;
+
+                if (pt->len) {
+                        char *buf = nla_data(nla);
+
+                        if (buf[attrlen - 1] == '\0')
+                                attrlen--;
+
+                        if (attrlen > pt->len)
+                                return -ERANGE;
+                }
+                break;
+
+        default:
+                if (pt->len)
+                        minlen = pt->len;
+                else if (pt->type != NLA_UNSPEC)
+                        minlen = nla_attr_minlen[pt->type];
+
+                if (attrlen < minlen)
+                        return -ERANGE;
+        }
 
         return 0;
 }
@@ -255,6 +284,26 @@ struct nlattr *__nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
 }
 
 /**
+ * __nla_reserve_nohdr - reserve room for attribute without header
+ * @skb: socket buffer to reserve room on
+ * @attrlen: length of attribute payload
+ *
+ * Reserves room for attribute payload without a header.
+ *
+ * The caller is responsible to ensure that the skb provides enough
+ * tailroom for the payload.
+ */
+void *__nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
+{
+        void *start;
+
+        start = skb_put(skb, NLA_ALIGN(attrlen));
+        memset(start, 0, NLA_ALIGN(attrlen));
+
+        return start;
+}
+
+/**
  * nla_reserve - reserve room for attribute on the skb
  * @skb: socket buffer to reserve room on
  * @attrtype: attribute type
@@ -275,6 +324,24 @@ struct nlattr *nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
 }
 
 /**
+ * nla_reserve - reserve room for attribute without header
+ * @skb: socket buffer to reserve room on
+ * @len: length of attribute payload
+ *
+ * Reserves room for attribute payload without a header.
+ *
+ * Returns NULL if the tailroom of the skb is insufficient to store
+ * the attribute payload.
+ */
+void *nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
+{
+        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
+                return NULL;
+
+        return __nla_reserve_nohdr(skb, attrlen);
+}
+
+/**
  * __nla_put - Add a netlink attribute to a socket buffer
  * @skb: socket buffer to add attribute to
  * @attrtype: attribute type
@@ -293,6 +360,22 @@ void __nla_put(struct sk_buff *skb, int attrtype, int attrlen,
         memcpy(nla_data(nla), data, attrlen);
 }
 
+/**
+ * __nla_put_nohdr - Add a netlink attribute without header
+ * @skb: socket buffer to add attribute to
+ * @attrlen: length of attribute payload
+ * @data: head of attribute payload
+ *
+ * The caller is responsible to ensure that the skb provides enough
+ * tailroom for the attribute payload.
+ */
+void __nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
+{
+        void *start;
+
+        start = __nla_reserve_nohdr(skb, attrlen);
+        memcpy(start, data, attrlen);
+}
 
 /**
  * nla_put - Add a netlink attribute to a socket buffer
@@ -313,15 +396,36 @@ int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
         return 0;
 }
 
+/**
+ * nla_put_nohdr - Add a netlink attribute without header
+ * @skb: socket buffer to add attribute to
+ * @attrlen: length of attribute payload
+ * @data: head of attribute payload
+ *
+ * Returns -1 if the tailroom of the skb is insufficient to store
+ * the attribute payload.
+ */
+int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
+{
+        if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
+                return -1;
+
+        __nla_put_nohdr(skb, attrlen, data);
+        return 0;
+}
 
 EXPORT_SYMBOL(nla_validate);
 EXPORT_SYMBOL(nla_parse);
 EXPORT_SYMBOL(nla_find);
 EXPORT_SYMBOL(nla_strlcpy);
 EXPORT_SYMBOL(__nla_reserve);
+EXPORT_SYMBOL(__nla_reserve_nohdr);
 EXPORT_SYMBOL(nla_reserve);
+EXPORT_SYMBOL(nla_reserve_nohdr);
 EXPORT_SYMBOL(__nla_put);
+EXPORT_SYMBOL(__nla_put_nohdr);
 EXPORT_SYMBOL(nla_put);
+EXPORT_SYMBOL(nla_put_nohdr);
 EXPORT_SYMBOL(nla_memcpy);
 EXPORT_SYMBOL(nla_memcmp);
 EXPORT_SYMBOL(nla_strcmp);
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index a298f77cc3e3..49bc2db7982b 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -387,7 +387,10 @@ static void genl_rcv(struct sock *sk, int len)
 static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
                           u32 flags, struct sk_buff *skb, u8 cmd)
 {
+        struct nlattr *nla_ops;
+        struct genl_ops *ops;
         void *hdr;
+        int idx = 1;
 
         hdr = genlmsg_put(skb, pid, seq, GENL_ID_CTRL, 0, flags, cmd,
                           family->version);
@@ -396,6 +399,37 @@ static int ctrl_fill_info(struct genl_family *family, u32 pid, u32 seq,
 
         NLA_PUT_STRING(skb, CTRL_ATTR_FAMILY_NAME, family->name);
         NLA_PUT_U16(skb, CTRL_ATTR_FAMILY_ID, family->id);
+        NLA_PUT_U32(skb, CTRL_ATTR_VERSION, family->version);
+        NLA_PUT_U32(skb, CTRL_ATTR_HDRSIZE, family->hdrsize);
+        NLA_PUT_U32(skb, CTRL_ATTR_MAXATTR, family->maxattr);
+
+        nla_ops = nla_nest_start(skb, CTRL_ATTR_OPS);
+        if (nla_ops == NULL)
+                goto nla_put_failure;
+
+        list_for_each_entry(ops, &family->ops_list, ops_list) {
+                struct nlattr *nest;
+
+                nest = nla_nest_start(skb, idx++);
+                if (nest == NULL)
+                        goto nla_put_failure;
+
+                NLA_PUT_U32(skb, CTRL_ATTR_OP_ID, ops->cmd);
+                NLA_PUT_U32(skb, CTRL_ATTR_OP_FLAGS, ops->flags);
+
+                if (ops->policy)
+                        NLA_PUT_FLAG(skb, CTRL_ATTR_OP_POLICY);
+
+                if (ops->doit)
+                        NLA_PUT_FLAG(skb, CTRL_ATTR_OP_DOIT);
+
+                if (ops->dumpit)
+                        NLA_PUT_FLAG(skb, CTRL_ATTR_OP_DUMPIT);
+
+                nla_nest_end(skb, nest);
+        }
+
+        nla_nest_end(skb, nla_ops);
 
         return genlmsg_end(skb, hdr);
 
@@ -411,6 +445,9 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
         int chains_to_skip = cb->args[0];
         int fams_to_skip = cb->args[1];
 
+        if (chains_to_skip != 0)
+                genl_lock();
+
         for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
                 if (i < chains_to_skip)
                         continue;
@@ -428,6 +465,9 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
         }
 
 errout:
+        if (chains_to_skip != 0)
+                genl_unlock();
+
         cb->args[0] = i;
         cb->args[1] = n;
 
@@ -440,7 +480,7 @@ static struct sk_buff *ctrl_build_msg(struct genl_family *family, u32 pid,
         struct sk_buff *skb;
         int err;
 
-        skb = nlmsg_new(NLMSG_GOODSIZE);
+        skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
         if (skb == NULL)
                 return ERR_PTR(-ENOBUFS);
 
@@ -455,7 +495,8 @@ static struct sk_buff *ctrl_build_msg(struct genl_family *family, u32 pid,
 
 static struct nla_policy ctrl_policy[CTRL_ATTR_MAX+1] __read_mostly = {
         [CTRL_ATTR_FAMILY_ID]   = { .type = NLA_U16 },
-        [CTRL_ATTR_FAMILY_NAME] = { .type = NLA_STRING },
+        [CTRL_ATTR_FAMILY_NAME] = { .type = NLA_NUL_STRING,
+                                    .len = GENL_NAMSIZ - 1 },
 };
 
 static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
@@ -470,12 +511,9 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (info->attrs[CTRL_ATTR_FAMILY_NAME]) {
-                char name[GENL_NAMSIZ];
-
-                if (nla_strlcpy(name, info->attrs[CTRL_ATTR_FAMILY_NAME],
-                                GENL_NAMSIZ) >= GENL_NAMSIZ)
-                        goto errout;
+                char *name;
 
+                name = nla_data(info->attrs[CTRL_ATTR_FAMILY_NAME]);
                 res = genl_family_find_byname(name);
         }
 
@@ -510,7 +548,7 @@ static int genl_ctrl_event(int event, void *data)
                 if (IS_ERR(msg))
                         return PTR_ERR(msg);
 
-                genlmsg_multicast(msg, 0, GENL_ID_CTRL);
+                genlmsg_multicast(msg, 0, GENL_ID_CTRL, GFP_KERNEL);
                 break;
         }