Cong Wang 6c2e795f95 tipc: fix uninit skb->data in tipc_nl_compat_dumpit() ... [ Upstream commit 47733f9daf ] __tipc_nl_compat_dumpit() has two callers, and it expects them to pass a valid nlmsghdr via arg->data. This header is artificial and crafted just for __tipc_nl_compat_dumpit(). tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well as some nested attribute, TIPC_NLA_SOCK. But the other caller tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized on this call path. Fix this by just adding a similar nlmsghdr without any payload in tipc_nl_compat_dumpit(). This bug exists since day 1, but the recent commit 6ea67769ff ("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it easier to appear. Reported-and-tested-by: syzbot+0e7181deafa7e0b79923@syzkaller.appspotmail.com Fixes: d0796d1ef6 ("tipc: convert legacy nl bearer dump to nl compat") Cc: Jon Maloy <jmaloy@redhat.com> Cc: Ying Xue <ying.xue@windriver.com> Cc: Richard Alpe <richard.alpe@ericsson.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-09-03 11:26:40 +02:00
..
Kconfig	…
Makefile	…
addr.c	…
addr.h	…
bcast.c	…
bcast.h	…
bearer.c	…
bearer.h	…
core.c	…
core.h	…
diag.c	…
discover.c	…
discover.h	…
eth_media.c	…
group.c	…
group.h	…
ib_media.c	…
link.c	…
link.h	…
monitor.c	…
monitor.h	…
msg.c	…
msg.h	…
name_distr.c	…
name_distr.h	…
name_table.c	…
name_table.h	…
net.c	…
net.h	…
netlink.c	…
netlink.h	…
netlink_compat.c	tipc: fix uninit skb->data in tipc_nl_compat_dumpit()	2020-09-03 11:26:40 +02:00
node.c	…
node.h	…
socket.c	…
socket.h	…
subscr.c	…
subscr.h	…
sysctl.c	…
topsrv.c	…
topsrv.h	…
trace.c	…
trace.h	…
udp_media.c	…
udp_media.h	…