Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f5c5fcf authored by Cong Wang's avatar Cong Wang Committed by David S. Miller
Browse files

tipc: call start and done ops directly in __tipc_nl_compat_dumpit() 



__tipc_nl_compat_dumpit() uses a netlink_callback on stack,
so the only way to align it with other ->dumpit() call path
is calling tipc_dump_start() and tipc_dump_done() directly
inside it. Otherwise ->dumpit() would always get NULL from
cb->args[].

But tipc_dump_start() uses sock_net(cb->skb->sk) to retrieve
net pointer, the cb->skb here doesn't set skb->sk, the net pointer
is saved in msg->net instead, so introduce a helper function
__tipc_dump_start() to pass in msg->net.

Ying pointed out cb->args[0...3] are already used by other
callbacks on this call path, so we can't use cb->args[0] any
more, use cb->args[4] instead.

Fixes: 9a07efa9 ("tipc: switch to rhashtable iterator")
Reported-and-tested-by: default avatar <syzbot+e93a2c41f91b8e2c7d9b@syzkaller.appspotmail.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Acked-by: default avatarYing Xue <ying.xue@windriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6da410d9

net/tipc/netlink_compat.c

+2 −0
Original line number Diff line number Diff line
@@ -185,6 +185,7 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, 
		return -ENOMEM;



	buf->sk = msg->dst_sk;

	__tipc_dump_start(&cb, msg->net);



	do {

		int rem;
@@ -216,6 +217,7 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, 
	err = 0;



err_out:

	tipc_dump_done(&cb);

	kfree_skb(buf);



	if (err == -EMSGSIZE) {

net/tipc/socket.c

+11 −6
Original line number Diff line number Diff line
@@ -3230,7 +3230,7 @@ int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb, 
				       struct netlink_callback *cb,

				       struct tipc_sock *tsk))

{

	struct rhashtable_iter *iter = (void *)cb->args[0];

	struct rhashtable_iter *iter = (void *)cb->args[4];

	struct tipc_sock *tsk;

	int err;
@@ -3266,8 +3266,14 @@ EXPORT_SYMBOL(tipc_nl_sk_walk); 


int tipc_dump_start(struct netlink_callback *cb)

{

	struct rhashtable_iter *iter = (void *)cb->args[0];

	struct net *net = sock_net(cb->skb->sk);

	return __tipc_dump_start(cb, sock_net(cb->skb->sk));

}

EXPORT_SYMBOL(tipc_dump_start);



int __tipc_dump_start(struct netlink_callback *cb, struct net *net)

{

	/* tipc_nl_name_table_dump() uses cb->args[0...3]. */

	struct rhashtable_iter *iter = (void *)cb->args[4];

	struct tipc_net *tn = tipc_net(net);



	if (!iter) {
@@ -3275,17 +3281,16 @@ int tipc_dump_start(struct netlink_callback *cb) 
		if (!iter)

			return -ENOMEM;



		cb->args[0] = (long)iter;

		cb->args[4] = (long)iter;

	}



	rhashtable_walk_enter(&tn->sk_rht, iter);

	return 0;

}

EXPORT_SYMBOL(tipc_dump_start);



int tipc_dump_done(struct netlink_callback *cb)

{

	struct rhashtable_iter *hti = (void *)cb->args[0];

	struct rhashtable_iter *hti = (void *)cb->args[4];



	rhashtable_walk_exit(hti);

	kfree(hti);

net/tipc/socket.h

+1 −0
Original line number Diff line number Diff line
@@ -69,5 +69,6 @@ int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb, 
				       struct netlink_callback *cb,

				       struct tipc_sock *tsk));

int tipc_dump_start(struct netlink_callback *cb);

int __tipc_dump_start(struct netlink_callback *cb, struct net *net);

int tipc_dump_done(struct netlink_callback *cb);

#endif