Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1194ed0a3eb8076c8fbfe310f1ccbf229e8647de
Commit:     1194ed0a3eb8076c8fbfe310f1ccbf229e8647de
Parent:     5044eed48886b105a123333fe7ca97c6bd496120
Author:     Alexey Kuznetsov <[EMAIL PROTECTED]>
AuthorDate: Wed Apr 25 13:07:28 2007 -0700
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Wed Apr 25 13:07:28 2007 -0700

    [NETLINK]: Infinite recursion in netlink.
    
    Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel,
    which resulted in infinite recursion and stack overflow.
    
    The bug is present in all kernel versions since the feature appeared.
    
    The patch also makes some minimal cleanup:
    
    1. Return something consistent (-ENOENT) when fib table is missing
    2. Do not crash when queue is empty (does not happen, but yet)
    3. Put result of lookup
    
    Signed-off-by: Alexey Kuznetsov <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 net/ipv4/fib_frontend.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index fc920f6..cac06c4 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -776,6 +776,8 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct 
fib_table *tb )
                                       .nl_u = { .ip4_u = { .daddr = 
frn->fl_addr,
                                                            .tos = frn->fl_tos,
                                                            .scope = 
frn->fl_scope } } };
+
+       frn->err = -ENOENT;
        if (tb) {
                local_bh_disable();
 
@@ -787,6 +789,7 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct 
fib_table *tb )
                        frn->nh_sel = res.nh_sel;
                        frn->type = res.type;
                        frn->scope = res.scope;
+                       fib_res_put(&res);
                }
                local_bh_enable();
        }
@@ -801,6 +804,9 @@ static void nl_fib_input(struct sock *sk, int len)
        struct fib_table *tb;
 
        skb = skb_dequeue(&sk->sk_receive_queue);
+       if (skb == NULL)
+               return;
+
        nlh = (struct nlmsghdr *)skb->data;
        if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
            nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
@@ -813,7 +819,7 @@ static void nl_fib_input(struct sock *sk, int len)
 
        nl_fib_lookup(frn, tb);
 
-       pid = nlh->nlmsg_pid;           /*pid of sending process */
+       pid = NETLINK_CB(skb).pid;       /* pid of sending process */
        NETLINK_CB(skb).pid = 0;         /* from kernel */
        NETLINK_CB(skb).dst_group = 0;  /* unicast */
        netlink_unicast(sk, skb, pid, MSG_DONTWAIT);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to