* Re: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
@ 2026-07-13 20:54 ` Helen Koike
2026-07-15 2:14 ` Tung Quang Nguyen
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Helen Koike @ 2026-07-13 20:54 UTC (permalink / raw)
To: jmaloy, davem, ying.xue, netdev, tipc-discussion, linux-kernel,
kernel-dev, erik.hugne
(cc + Erik)
On 7/13/26 5:49 PM, Helen Koike wrote:
> cmd->dumpit callback can return a negative errno, causing an infinite
> loop due to the while(len) condition. As the loop never terminates,
> genl_mutex is never released, and other tasks waiting on it starve in D
> state.
>
> Check dumpit's return value, propagate it and jump to err_out on error.
>
> Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
> Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
> Signed-off-by: Helen Koike <koike@igalia.com>
> ---
>
> Tested locally using syzbot reproducer.
> ---
> net/tipc/netlink_compat.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
> index 2a786c56c8c5..d9a4f94ea2d4 100644
> --- a/net/tipc/netlink_compat.c
> +++ b/net/tipc/netlink_compat.c
> @@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
> int rem;
>
> len = (*cmd->dumpit)(buf, &cb);
> + if (len < 0) {
> + err = len;
> + goto err_out;
> + }
>
> nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
> err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
^ permalink raw reply [flat|nested] 5+ messages in thread* RE: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
2026-07-13 20:54 ` Helen Koike
@ 2026-07-15 2:14 ` Tung Quang Nguyen
2026-07-15 2:17 ` Tung Quang Nguyen
2026-07-21 22:20 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Tung Quang Nguyen @ 2026-07-15 2:14 UTC (permalink / raw)
To: Helen Koike
Cc: jmaloy@redhat.com, davem@davemloft.net, netdev@vger.kernel.org,
tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, kernel-dev@igalia.com
>Subject: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
>
>cmd->dumpit callback can return a negative errno, causing an infinite
>loop due to the while(len) condition. As the loop never terminates,
>genl_mutex is never released, and other tasks waiting on it starve in D state.
>
>Check dumpit's return value, propagate it and jump to err_out on error.
>
>Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
>Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
>Signed-off-by: Helen Koike <koike@igalia.com>
>---
>
>Tested locally using syzbot reproducer.
>---
> net/tipc/netlink_compat.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index
>2a786c56c8c5..d9a4f94ea2d4 100644
>--- a/net/tipc/netlink_compat.c
>+++ b/net/tipc/netlink_compat.c
>@@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct
>tipc_nl_compat_cmd_dump *cmd,
> int rem;
>
> len = (*cmd->dumpit)(buf, &cb);
>+ if (len < 0) {
>+ err = len;
>+ goto err_out;
>+ }
>
> nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
> err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
>--
>2.54.0
>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech
^ permalink raw reply [flat|nested] 5+ messages in thread* RE: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
2026-07-13 20:54 ` Helen Koike
2026-07-15 2:14 ` Tung Quang Nguyen
@ 2026-07-15 2:17 ` Tung Quang Nguyen
2026-07-21 22:20 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Tung Quang Nguyen @ 2026-07-15 2:17 UTC (permalink / raw)
To: Helen Koike
Cc: jmaloy@redhat.com, davem@davemloft.net, netdev@vger.kernel.org,
tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, kernel-dev@igalia.com
>Subject: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
>
>cmd->dumpit callback can return a negative errno, causing an infinite
>loop due to the while(len) condition. As the loop never terminates,
>genl_mutex is never released, and other tasks waiting on it starve in D state.
>
>Check dumpit's return value, propagate it and jump to err_out on error.
>
>Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
>Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
>Signed-off-by: Helen Koike <koike@igalia.com>
>---
>
>Tested locally using syzbot reproducer.
>---
> net/tipc/netlink_compat.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index
>2a786c56c8c5..d9a4f94ea2d4 100644
>--- a/net/tipc/netlink_compat.c
>+++ b/net/tipc/netlink_compat.c
>@@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct
>tipc_nl_compat_cmd_dump *cmd,
> int rem;
>
> len = (*cmd->dumpit)(buf, &cb);
>+ if (len < 0) {
>+ err = len;
>+ goto err_out;
>+ }
>
> nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
> err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
>--
>2.54.0
>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
` (2 preceding siblings ...)
2026-07-15 2:17 ` Tung Quang Nguyen
@ 2026-07-21 22:20 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-07-21 22:20 UTC (permalink / raw)
To: Helen Koike
Cc: jmaloy, davem, erik.hugne, ying.xue, netdev, tipc-discussion,
linux-kernel, kernel-dev
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 13 Jul 2026 17:49:35 -0300 you wrote:
> cmd->dumpit callback can return a negative errno, causing an infinite
> loop due to the while(len) condition. As the loop never terminates,
> genl_mutex is never released, and other tasks waiting on it starve in D
> state.
>
> Check dumpit's return value, propagate it and jump to err_out on error.
>
> [...]
Here is the summary with links:
- [net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
https://git.kernel.org/netdev/net/c/22f8aa35964e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread