ipv6: Fix error path to cancel the meseage

genlmsg_cancel() needs to be called in the error path of
inet6_fill_ifmcaddr and inet6_fill_ifacaddr to cancel
the message.

Fixes: 6ecf4c37eb3e ("ipv6: enable IFA_TARGET_NETNSID for RTM_GETADDR")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201112080950.1476302-1-zhangqilong3@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 01146b66d6669f37abf884643caf891d9972db90..8b6eb384bac7cac2f46b119a1ad851465a836ad7 100644 (file)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5022,8 +5022,10 @@ static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
                return -EMSGSIZE;
 
        if (args->netnsid >= 0 &&
-           nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid))
+           nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
+               nlmsg_cancel(skb, nlh);
                return -EMSGSIZE;
+       }
 
        put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
        if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 ||
@@ -5054,8 +5056,10 @@ static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
                return -EMSGSIZE;
 
        if (args->netnsid >= 0 &&
-           nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid))
+           nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
+               nlmsg_cancel(skb, nlh);
                return -EMSGSIZE;
+       }
 
        put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
        if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 ||