Re: [PATCH] TIPC: Fix infinite loop in netlink handler

[Patrick McHardy <kaber@trash.net>]

Florian Westphal wrote:
> From: Florian Westphal <fw@strlen.de>
> 
> The tipc netlink config handler uses the nlmsg_pid from the
> request header as destination for its reply. If the application
> initialized nlmsg_pid to 0, the reply is looped back to the kernel,
> causing hangup. Fix: use nlmsg_pid of the skb that triggered the
> request.
> 
> -		genlmsg_unicast(rep_buf, req_nlh->nlmsg_pid);
> +		genlmsg_unicast(rep_buf, NETLINK_CB(skb).pid);


This is the second time we're seeing this bug within a few weeks,
maybe we should rename NETLINK_CB(skb).pid to dst_pid to avoid
similar confusion in the future? We could even rename nlmsg_pid
to nlmsg_src within the kernel, which should make it completely
clear what is being refered to.