• Jiri Pirko's avatar
    net: genetlink: always allocate separate attrs for dumpit ops · ab5b526d
    Jiri Pirko authored
    Individual dumpit ops (start, dumpit, done) are locked by genl_lock
    if !family->parallel_ops. However, multiple
    genl_family_rcv_msg_dumpit() calls may in in flight in parallel.
    Each has a separate struct genl_dumpit_info allocated
    but they share the same family->attrbuf. Fix this by allocating separate
    memory for attrs for dumpit ops, for non-parallel_ops (for parallel_ops
    it is done already).
    
    Reported-by: syzbot+495688b736534bb6c6ad@syzkaller.appspotmail.com
    Reported-by: syzbot+ff59dc711f2cff879a05@syzkaller.appspotmail.com
    Reported-by: syzbot+dbe02e13bcce52bcf182@syzkaller.appspotmail.com
    Reported-by: syzbot+9cb7edb2906ea1e83006@syzkaller.appspotmail.com
    Fixes: bf813b0a ("net: genetlink: parse attrs and store in contect info struct during dumpit")
    Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
    Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
    ab5b526d
genetlink.c 27.9 KB