From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: [Patch net] tipc: call start and done ops directly in __tipc_nl_compat_dumpit() Date: Mon, 3 Sep 2018 12:49:41 -0700 Message-ID: <20180903194941.23900-1-xiyou.wangcong@gmail.com> Cc: Cong Wang , Jon Maloy , Ying Xue To: netdev@vger.kernel.org Return-path: Received: from mail-pf1-f195.google.com ([209.85.210.195]:40603 "EHLO mail-pf1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728445AbeIDALb (ORCPT ); Mon, 3 Sep 2018 20:11:31 -0400 Received: by mail-pf1-f195.google.com with SMTP id s13-v6so556486pfi.7 for ; Mon, 03 Sep 2018 12:49:50 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: __tipc_nl_compat_dumpit() uses a netlink_callback on stack, so the only way to align it with other ->dumpit() call path is calling tipc_dump_start() and tipc_dump_done() directly inside it. Otherwise ->dumpit() would always get NULL from cb->args[0]. Fixes: 9a07efa9aea2 ("tipc: switch to rhashtable iterator") Reported-by: syzbot+e93a2c41f91b8e2c7d9b@syzkaller.appspotmail.com Cc: Jon Maloy Cc: Ying Xue Signed-off-by: Cong Wang --- net/tipc/netlink_compat.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index a2f76743c73a..aa05934613f2 100644 --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -185,6 +185,7 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, return -ENOMEM; buf->sk = msg->dst_sk; + tipc_dump_start(&cb); do { int rem; @@ -216,6 +217,7 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, err = 0; err_out: + tipc_dump_done(&cb); kfree_skb(buf); if (err == -EMSGSIZE) { -- 2.14.4