tipc: do sanity check payload of a netlink message
authorHoang Le <hoang.h.le@dektech.com.au>
Tue, 15 Dec 2020 03:31:51 +0000 (10:31 +0700)
committerJakub Kicinski <kuba@kernel.org>
Wed, 16 Dec 2020 20:45:02 +0000 (12:45 -0800)
When we initialize nlmsghdr with no payload inside tipc_nl_compat_dumpit()
the parsing function returns -EINVAL. We fix it by making the parsing call
conditional.

Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Link: https://lore.kernel.org/r/20201215033151.76139-1-hoang.h.le@dektech.com.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/tipc/netlink_compat.c

index 82f1549..5a1ce64 100644 (file)
@@ -213,12 +213,14 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
        }
 
        info.attrs = attrbuf;
-       err = nlmsg_parse_deprecated(cb.nlh, GENL_HDRLEN, attrbuf,
-                                    tipc_genl_family.maxattr,
-                                    tipc_genl_family.policy, NULL);
-       if (err)
-               goto err_out;
 
+       if (nlmsg_len(cb.nlh) > 0) {
+               err = nlmsg_parse_deprecated(cb.nlh, GENL_HDRLEN, attrbuf,
+                                            tipc_genl_family.maxattr,
+                                            tipc_genl_family.policy, NULL);
+               if (err)
+                       goto err_out;
+       }
        do {
                int rem;