* [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
@ 2026-07-13 20:49 Helen Koike
2026-07-13 20:54 ` Helen Koike
0 siblings, 1 reply; 2+ messages in thread
From: Helen Koike @ 2026-07-13 20:49 UTC (permalink / raw)
To: jmaloy, davem, erik.hugne, ying.xue, netdev, tipc-discussion,
linux-kernel, koike, kernel-dev
cmd->dumpit callback can return a negative errno, causing an infinite
loop due to the while(len) condition. As the loop never terminates,
genl_mutex is never released, and other tasks waiting on it starve in D
state.
Check dumpit's return value, propagate it and jump to err_out on error.
Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Signed-off-by: Helen Koike <koike@igalia.com>
---
Tested locally using syzbot reproducer.
---
net/tipc/netlink_compat.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 2a786c56c8c5..d9a4f94ea2d4 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
int rem;
len = (*cmd->dumpit)(buf, &cb);
+ if (len < 0) {
+ err = len;
+ goto err_out;
+ }
nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
--
2.54.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
@ 2026-07-13 20:54 ` Helen Koike
0 siblings, 0 replies; 2+ messages in thread
From: Helen Koike @ 2026-07-13 20:54 UTC (permalink / raw)
To: jmaloy, davem, ying.xue, netdev, tipc-discussion, linux-kernel,
kernel-dev, erik.hugne
(cc + Erik)
On 7/13/26 5:49 PM, Helen Koike wrote:
> cmd->dumpit callback can return a negative errno, causing an infinite
> loop due to the while(len) condition. As the loop never terminates,
> genl_mutex is never released, and other tasks waiting on it starve in D
> state.
>
> Check dumpit's return value, propagate it and jump to err_out on error.
>
> Reported-by: syzbot+85d0bec020d805014a3a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=85d0bec020d805014a3a
> Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
> Signed-off-by: Helen Koike <koike@igalia.com>
> ---
>
> Tested locally using syzbot reproducer.
> ---
> net/tipc/netlink_compat.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
> index 2a786c56c8c5..d9a4f94ea2d4 100644
> --- a/net/tipc/netlink_compat.c
> +++ b/net/tipc/netlink_compat.c
> @@ -221,6 +221,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
> int rem;
>
> len = (*cmd->dumpit)(buf, &cb);
> + if (len < 0) {
> + err = len;
> + goto err_out;
> + }
>
> nlmsg_for_each_msg(nlmsg, nlmsg_hdr(buf), len, rem) {
> err = nlmsg_parse_deprecated(nlmsg, GENL_HDRLEN,
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-07-13 20:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 20:49 [PATCH net] tipc: fix infinite loop in __tipc_nl_compat_dumpit Helen Koike
2026-07-13 20:54 ` Helen Koike
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox