• Alexey Kodanev's avatar
    rtnetlink: restore handling of dumpit return value in rtnl_dump_all() · 5e1acb4a
    Alexey Kodanev authored
    For non-zero return from dumpit() we should break the loop
    in rtnl_dump_all() and return the result. Otherwise, e.g.,
    we could get the memory leak in inet6_dump_fib() [1]. The
    pointer to the allocated struct fib6_walker there (saved
    in cb->args) can be lost, reset on the next iteration.
    
    Fix it by partially restoring the previous behavior before
    commit c63586dc ("net: rtnl_dump_all needs to propagate
    error from dumpit function"). The returned error from
    dumpit() is still passed further.
    
    [1]:
    unreferenced object 0xffff88001322a200 (size 96):
      comm "sshd", pid 1484, jiffies 4296032768 (age 1432.542s)
      hex dump (first 32 bytes):
        00 01 00 00 00 00 ad de 00 02 00 00 00 00 ad de  ................
        18 09 41 36 00 88 ff ff 18 09 41 36 00 88 ff ff  ..A6......A6....
      backtrace:
        [<0000000095846b39>] kmem_cache_alloc_trace+0x151/0x220
        [<000000007d12709f>] inet6_dump_fib+0x68d/0x940
        [<000000002775a316>] rtnl_dump_all+0x1d9/0x2d0
        [<00000000d7cd302b>] netlink_dump+0x945/0x11a0
        [<000000002f43485f>] __netlink_dump_start+0x55d/0x800
        [<00000000f76bbeec>] rtnetlink_rcv_msg+0x4fa/0xa00
        [<000000009b5761f3>] netlink_rcv_skb+0x29c/0x420
        [<0000000087a1dae1>] rtnetlink_rcv+0x15/0x20
        [<00000000691b703b>] netlink_unicast+0x4e3/0x6c0
        [<00000000b5be0204>] netlink_sendmsg+0x7f2/0xba0
        [<0000000096d2aa60>] sock_sendmsg+0xba/0xf0
        [<000000008c1b786f>] __sys_sendto+0x1e4/0x330
        [<0000000019587b3f>] __x64_sys_sendto+0xe1/0x1a0
        [<00000000071f4d56>] do_syscall_64+0x9f/0x300
        [<000000002737577f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
        [<0000000057587684>] 0xffffffffffffffff
    
    Fixes: c63586dc ("net: rtnl_dump_all needs to propagate error from dumpit function")
    Signed-off-by: default avatarAlexey Kodanev <alexey.kodanev@oracle.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    5e1acb4a
rtnetlink.c 122 KB