diff options
author | Cong Wang <[email protected]> | 2020-08-15 16:29:15 -0700 |
---|---|---|
committer | David S. Miller <[email protected]> | 2020-08-16 21:03:19 -0700 |
commit | 47733f9daf4fe4f7e0eb9e273f21ad3a19130487 (patch) | |
tree | 97b766085a58dd6702ea9d14d827c38f9eaf17b8 /scripts/gdb/linux/timerlist.py | |
parent | 8c26544f5ace22ee159113a3300de077f2973519 (diff) |
tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
__tipc_nl_compat_dumpit() has two callers, and it expects them to
pass a valid nlmsghdr via arg->data. This header is artificial and
crafted just for __tipc_nl_compat_dumpit().
tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well
as some nested attribute, TIPC_NLA_SOCK. But the other caller
tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized
on this call path.
Fix this by just adding a similar nlmsghdr without any payload in
tipc_nl_compat_dumpit().
This bug exists since day 1, but the recent commit 6ea67769ff33
("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it
easier to appear.
Reported-and-tested-by: [email protected]
Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Cc: Jon Maloy <[email protected]>
Cc: Ying Xue <[email protected]>
Cc: Richard Alpe <[email protected]>
Signed-off-by: Cong Wang <[email protected]>
Acked-by: Ying Xue <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'scripts/gdb/linux/timerlist.py')
0 files changed, 0 insertions, 0 deletions