diff options
| author | Helen Koike <koike@igalia.com> | 2026-07-13 17:49:35 -0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-07-21 15:12:23 -0700 |
| commit | 22f8aa35964e8f2ab026578f45befc9605fd1b28 (patch) | |
| tree | 85693c96d63fcc085a08f8c741b6b86de26ac84b | |
| parent | 6347c5314cee49f364aaf2e40ff15415a57a116e (diff) | |
| download | linux-22f8aa35964e8f2ab026578f45befc9605fd1b28.tar.gz linux-22f8aa35964e8f2ab026578f45befc9605fd1b28.zip | |
tipc: fix infinite loop in __tipc_nl_compat_dumpit
cmd->dumpit callback can return a negative errno, causing an infinite
loop due to the while(len) condition. As the loop never terminates,
genl_mutex is never released, and other tasks waiting on it starve in D
state.
Check dumpit's return value, propagate it and jump to err_out on error.
Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Signed-off-by: Helen Koike <koike@igalia.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260713204940.647668-1-koike@igalia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/tipc/netlink_compat.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index 2a786c56c8c5..d9a4f94ea2d4 100644 --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, int rem; len = (*cmd->dumpit)(buf, &cb); + if (len < 0) { + err = len; + goto err_out; + } nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) { err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN, |