netdev - Re: [PATCH] TIPC: Fix infinite loop in netlink handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <46784B7F.8050903@trash.net>
Date:	Tue, 19 Jun 2007 23:32:47 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Florian Westphal <fw-kernel@...len.de>
CC:	netdev@...r.kernel.org, jon.maloy@...csson.com,
	allan.stephens@...driver.com, per.liden@...csson.com,
	tipc-discussion@...ts.sourceforge.net
Subject: Re: [PATCH] TIPC: Fix infinite loop in netlink handler

Florian Westphal wrote:
> From: Florian Westphal <fw@...len.de>
> 
> The tipc netlink config handler uses the nlmsg_pid from the
> request header as destination for its reply. If the application
> initialized nlmsg_pid to 0, the reply is looped back to the kernel,
> causing hangup. Fix: use nlmsg_pid of the skb that triggered the
> request.
> 
> -		genlmsg_unicast(rep_buf, req_nlh->nlmsg_pid);
> +		genlmsg_unicast(rep_buf, NETLINK_CB(skb).pid);

This is the second time we're seeing this bug within a few weeks,
maybe we should rename NETLINK_CB(skb).pid to dst_pid to avoid
similar confusion in the future? We could even rename nlmsg_pid
to nlmsg_src within the kernel, which should make it completely
clear what is being refered to.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html