proxmox-mirrors/mirror_iproute2
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_iproute2 synced 2025-12-07 14:41:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

libnetlink: fix leak and using unused memory on error

Browse Source 
If an error happens in multi-segment message (tc only)
then report the error and stop processing further responses.
This also fixes refering to the buffer after free.

The sequence check is not necessary here because the
response message has already been validated to be in
the window of the sequence number of the iov.

Reported-by: Mahesh Bandewar <mahesh@bandewar.net>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Mahesh Bandewar <maheshb@google.com>
This commit is contained in:
Stephen Hemminger 2018-09-13 12:33:38 -07:00
parent 2153e01f36
commit c60389e4f9
1 changed files with 9 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
lib/libnetlink.c
View File

@ -617,7 +617,6 @@ static int __rtnl_talk_iov(struct rtnl_handle *rtnl, struct iovec *iov,
msg.msg_iovlen = 1;
i = 0;
while (1) {
next:
status = rtnl_recvmsg(rtnl->fd, &msg, &buf);
++i;
@ -660,27 +659,23 @@ next:
if (l < sizeof(struct nlmsgerr)) {
fprintf(stderr, "ERROR truncated\n");
} else if (!err->error) {
free(buf);
return -1;
}
if (!err->error)
/* check messages from kernel */
nl_dump_ext_ack(h, errfn);
if (answer)
*answer = (struct nlmsghdr *)buf;
else
free(buf);
if (h->nlmsg_seq == seq)
return 0;
else if (i < iovlen)
goto next;
return 0;
}
if (rtnl->proto != NETLINK_SOCK_DIAG &&
show_rtnl_err)
rtnl_talk_error(h, err, errfn);
errno = -err->error;
free(buf);
if (answer)
*answer = (struct nlmsghdr *)buf;
else
free(buf);
return -i;
}