Re: [PATCH] net/wireless/nl80211.c: fix endless Netlink callback loop.

[Johannes Berg <johannes@sipsolutions.net>]

[-- Attachment #1: Type: text/plain, Size: 1565 bytes --]

On Tue, 2008-07-08 at 14:02 +0200, Julius Volz wrote:
> Although I only tested similar code (I don't use any of this wireless
> code), the state maintainance between Netlink dump callback invocations
> seems wrong here and should lead to an endless loop. There are also other
> examples in the same file which might have the same problem. Perhaps someone
> can actually test this (or refute my logic).
> 
> Take the simple example with only one element in the list (which should fit
> into the message):

> Also, iterations where the filling of an element fails should not be counted as
> completed, so idx should not be incremented in this case.

Seems to be the case on both points, however,

> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -194,22 +194,24 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
>  static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
>  {
>  	int idx = 0;
>  	int start = cb->args[0];
>  	struct cfg80211_registered_device *dev;
>  
>  	mutex_lock(&cfg80211_drv_mutex);
>  	list_for_each_entry(dev, &cfg80211_drv_list, list) {
> -		if (++idx < start)
> +		if (++idx <= start)
>  			continue;
>  		if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
>  				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
> -				       dev) < 0)
> +				       dev) < 0) {
> +			idx--;
>  			break;
> +		}

I see much of the problem stemming from incrementing 'idx' at the
beginning of the loop, can't we just move it to the end?

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]