• Jason A. Donenfeld's avatar
    netlink: do not proceed if dump's start() errs · fef0035c
    Jason A. Donenfeld authored
    Drivers that use the start method for netlink dumping rely on dumpit not
    being called if start fails. For example, ila_xlat.c allocates memory
    and assigns it to cb->args[0] in its start() function. It might fail to
    do that and return -ENOMEM instead. However, even when returning an
    error, dumpit will be called, which, in the example above, quickly
    dereferences the memory in cb->args[0], which will OOPS the kernel. This
    is but one example of how this goes wrong.
    
    Since start() has always been a function with an int return type, it
    therefore makes sense to use it properly, rather than ignoring it. This
    patch thus returns early and does not call dumpit() when start() fails.
    Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    Cc: Johannes Berg <johannes@sipsolutions.net>
    Reviewed-by: default avatarJohannes Berg <johannes@sipsolutions.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    fef0035c
af_netlink.c 63.6 KB