]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
tipc: call start and done ops directly in __tipc_nl_compat_dumpit()
authorCong Wang <xiyou.wangcong@gmail.com>
Tue, 4 Sep 2018 21:54:55 +0000 (14:54 -0700)
committerDavid S. Miller <davem@davemloft.net>
Fri, 7 Sep 2018 04:49:18 +0000 (21:49 -0700)
commit8f5c5fcf353302374b36232d6885c1a3b579e5ca
tree9dc9fc708ad4252bb2ecec4e9c250ea15ab897ee
parent6da410d97ffa486eb0379236d5444e5f4527c07a
tipc: call start and done ops directly in __tipc_nl_compat_dumpit()

__tipc_nl_compat_dumpit() uses a netlink_callback on stack,
so the only way to align it with other ->dumpit() call path
is calling tipc_dump_start() and tipc_dump_done() directly
inside it. Otherwise ->dumpit() would always get NULL from
cb->args[].

But tipc_dump_start() uses sock_net(cb->skb->sk) to retrieve
net pointer, the cb->skb here doesn't set skb->sk, the net pointer
is saved in msg->net instead, so introduce a helper function
__tipc_dump_start() to pass in msg->net.

Ying pointed out cb->args[0...3] are already used by other
callbacks on this call path, so we can't use cb->args[0] any
more, use cb->args[4] instead.

Fixes: 9a07efa9aea2 ("tipc: switch to rhashtable iterator")
Reported-and-tested-by: syzbot+e93a2c41f91b8e2c7d9b@syzkaller.appspotmail.com
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/netlink_compat.c
net/tipc/socket.c
net/tipc/socket.h