History

[NETLINK]: Infinite recursion in netlink.

Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, which resulted in infinite recursion and stack overflow. The bug is present in all kernel versions since the feature appeared. The patch also makes some minimal cleanup: 1. Return something consistent (-ENOENT) when fib table is missing 2. Do not crash when queue is empty (does not happen, but yet) 3. Put result of lookup

Alexey Kuznetsov committed 19 years ago

Commit 1194ed01 parent 5044eed1 file · +7 −1Browse files

Unified · Split

net/ipv4/fib_frontend.c+7−1
@@ -776,6 +776,8 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb ) · 775 unmodified lines
776776 .nl_u = { .ip4_u = { .daddr = frn->fl_addr,
777777 .tos = frn->fl_tos,
778778 .scope = frn->fl_scope } } };
779+
780+ frn->err = -ENOENT;
779781 if (tb) {
780782 local_bh_disable();
781783
@@ -787,6 +789,7 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb ) · 5 unmodified lines
787789 frn->nh_sel = res.nh_sel;
788790 frn->type = res.type;
789791 frn->scope = res.scope;
792+ fib_res_put(&res);
790793 }
791794 local_bh_enable();
792795 }
@@ -801,6 +804,9 @@ static void nl_fib_input(struct sock *sk, int len) · 8 unmodified lines
801804 struct fib_table *tb;
802805
803806 skb = skb_dequeue(&sk->sk_receive_queue);
807+ if (skb == NULL)
808+ return;
809+
804810 nlh = (struct nlmsghdr *)skb->data;
805811 if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
806812 nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
@@ -813,7 +819,7 @@ static void nl_fib_input(struct sock *sk, int len) · 6 unmodified lines
813819
814820 nl_fib_lookup(frn, tb);
815821
816− pid = nlh->nlmsg_pid; /*pid of sending process */
822+ pid = NETLINK_CB(skb).pid; /* pid of sending process */
817823 NETLINK_CB(skb).pid = 0; /* from kernel */
818824 NETLINK_CB(skb).dst_group = 0; /* unicast */
819825 netlink_unicast(sk, skb, pid, MSG_DONTWAIT);