diff options
| author | Hui Peng <benquike@gmail.com> | 2026-09-19 21:06:24 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-23 19:14:25 -0700 |
| commit | 528de6832b2194ae0b1d62b0925e0ac6cad1087c (patch) | |
| tree | b3a5f0643202fc5beb612f6ace19085071cd5c0e /include/linux/timerqueue.h | |
| parent | 63182028f38b703d3c28e18aacf262dc7e4de866 (diff) | |
net/sched: ematch: check nla_put_nohdr() return value in tcf_em_tree_dump()
When tcf_em_tree_dump() was converted from the legacy rtnetlink
`RTA_PUT_NOHDR` macro (which contained an implicit `goto
rtattr_failure;`) to `nla_put_nohdr()`, the return value check on
`nla_put_nohdr()` was omitted for container/simple matches and raw match
payloads.
If the netlink dump skb runs out of tailroom at `nla_put_nohdr()`, the
error is silently ignored and `match_start->nla_len` is finalized
without the match payload, emitting a malformed/truncated
TCA_EMATCH_TREE_LIST attribute to userspace instead of returning `-1`
via `nla_put_failure` so rtnetlink can reallocate and retry the dump.
Check the return value of `nla_put_nohdr()` in both branches and jump to
`nla_put_failure` on error.
Cc: stable+noautosel@kernel.org # never worked
Signed-off-by: Hui Peng <benquike@gmail.com>
Link: https://patch.msgid.link/20260919210624.3030344-1-benquike@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/linux/timerqueue.h')
0 files changed, 0 insertions, 0 deletions
