* [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
@ 2026-07-13 20:49 Helen Koike
2026-07-13 20:54 ` Helen Koike
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Helen Koike @ 2026-07-13 20:49 UTC (permalink / raw)
To: jmaloy, davem, erik.hugne, ying.xue, netdev, tipc-discussion,
linux-kernel, koike, kernel-dev
cmd->dumpit callback can return a negative errno, causing an infinite
loop due to the while(len) condition. As the loop never terminates,
genl_mutex is never released, and other tasks waiting on it starve in D
state.
Check dumpit's return value, propagate it and jump to err_out on error.
Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Signed-off-by: Helen Koike <koike@igalia.com>
---
Tested locally using syzbot reproducer.
---
net/tipc/netlink_compat.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 2a786c56c8c5..d9a4f94ea2d4 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
int rem;
len = (*cmd->dumpit)(buf, &cb);
+ if (len < 0) {
+ err = len;
+ goto err_out;
+ }
nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
--
2.54.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
@ 2026-07-13 20:54 ` Helen Koike
2026-07-15 2:14 ` Tung Quang Nguyen
2026-07-15 2:17 ` Tung Quang Nguyen
2 siblings, 0 replies; 4+ messages in thread
From: Helen Koike @ 2026-07-13 20:54 UTC (permalink / raw)
To: jmaloy, davem, ying.xue, netdev, tipc-discussion, linux-kernel,
kernel-dev, erik.hugne
(cc + Erik)
On 7/13/26 5:49 PM, Helen Koike wrote:
> cmd->dumpit callback can return a negative errno, causing an infinite
> loop due to the while(len) condition. As the loop never terminates,
> genl_mutex is never released, and other tasks waiting on it starve in D
> state.
>
> Check dumpit's return value, propagate it and jump to err_out on error.
>
> Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
> Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
> Signed-off-by: Helen Koike <koike@igalia.com>
> ---
>
> Tested locally using syzbot reproducer.
> ---
> net/tipc/netlink_compat.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
> index 2a786c56c8c5..d9a4f94ea2d4 100644
> --- a/net/tipc/netlink_compat.c
> +++ b/net/tipc/netlink_compat.c
> @@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
> int rem;
>
> len = (*cmd->dumpit)(buf, &cb);
> + if (len < 0) {
> + err = len;
> + goto err_out;
> + }
>
> nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
> err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
^ permalink raw reply [flat|nested] 4+ messages in thread* RE: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
2026-07-13 20:54 ` Helen Koike
@ 2026-07-15 2:14 ` Tung Quang Nguyen
2026-07-15 2:17 ` Tung Quang Nguyen
2 siblings, 0 replies; 4+ messages in thread
From: Tung Quang Nguyen @ 2026-07-15 2:14 UTC (permalink / raw)
To: Helen Koike
Cc: jmaloy@redhat.com, davem@davemloft.net, netdev@vger.kernel.org,
tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, kernel-dev@igalia.com
>Subject: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
>
>cmd->dumpit callback can return a negative errno, causing an infinite
>loop due to the while(len) condition. As the loop never terminates,
>genl_mutex is never released, and other tasks waiting on it starve in D state.
>
>Check dumpit's return value, propagate it and jump to err_out on error.
>
>Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
>Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
>Signed-off-by: Helen Koike <koike@igalia.com>
>---
>
>Tested locally using syzbot reproducer.
>---
> net/tipc/netlink_compat.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index
>2a786c56c8c5..d9a4f94ea2d4 100644
>--- a/net/tipc/netlink_compat.c
>+++ b/net/tipc/netlink_compat.c
>@@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct
>tipc_nl_compat_cmd_dump *cmd,
> int rem;
>
> len = (*cmd->dumpit)(buf, &cb);
>+ if (len < 0) {
>+ err = len;
>+ goto err_out;
>+ }
>
> nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
> err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
>--
>2.54.0
>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech
^ permalink raw reply [flat|nested] 4+ messages in thread* RE: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
2026-07-13 20:54 ` Helen Koike
2026-07-15 2:14 ` Tung Quang Nguyen
@ 2026-07-15 2:17 ` Tung Quang Nguyen
2 siblings, 0 replies; 4+ messages in thread
From: Tung Quang Nguyen @ 2026-07-15 2:17 UTC (permalink / raw)
To: Helen Koike
Cc: jmaloy@redhat.com, davem@davemloft.net, netdev@vger.kernel.org,
tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, kernel-dev@igalia.com
>Subject: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
>
>cmd->dumpit callback can return a negative errno, causing an infinite
>loop due to the while(len) condition. As the loop never terminates,
>genl_mutex is never released, and other tasks waiting on it starve in D state.
>
>Check dumpit's return value, propagate it and jump to err_out on error.
>
>Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
>Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
>Signed-off-by: Helen Koike <koike@igalia.com>
>---
>
>Tested locally using syzbot reproducer.
>---
> net/tipc/netlink_compat.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index
>2a786c56c8c5..d9a4f94ea2d4 100644
>--- a/net/tipc/netlink_compat.c
>+++ b/net/tipc/netlink_compat.c
>@@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct
>tipc_nl_compat_cmd_dump *cmd,
> int rem;
>
> len = (*cmd->dumpit)(buf, &cb);
>+ if (len < 0) {
>+ err = len;
>+ goto err_out;
>+ }
>
> nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
> err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
>--
>2.54.0
>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-15 2:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
2026-07-13 20:54 ` Helen Koike
2026-07-15 2:14 ` Tung Quang Nguyen
2026-07-15 2:17 ` Tung Quang Nguyen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox