| Message ID | 20180601155016.3524-1-dsahern@kernel.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | stephen hemminger |
| Headers | show |
| Series | [iproute2] iplink_vrf: Save device index from response for return code | expand |
On Fri, Jun 01, 2018 at 08:50:16AM -0700, dsahern@kernel.org wrote: > From: David Ahern <dsahern@gmail.com> > > A recent commit changed rtnl_talk_* to return the response message in > allocated memory so callers need to free it. The change to name_is_vrf > did not save the device index which is pointing to a struct inside the > now allocated and freed memory resulting in garbage getting returned > in some cases. > > Fix by using a stack variable to save the return value and only set > it to ifi->ifi_index after all checks are done and before the answer > buffer is freed. > > Fixes: 86bf43c7c2fdc ("lib/libnetlink: update rtnl_talk to support malloc buff at run time") > Cc: Hangbin Liu <liuhangbin@gmail.com> > Cc: Phil Sutter <phil@nwl.cc> > Signed-off-by: David Ahern <dsahern@gmail.com> Acked-by: Phil Sutter <phil@nwl.cc> Thanks, Phil
On Fri, Jun 01, 2018 at 08:50:16AM -0700, dsahern@kernel.org wrote: > From: David Ahern <dsahern@gmail.com> > > A recent commit changed rtnl_talk_* to return the response message in > allocated memory so callers need to free it. The change to name_is_vrf > did not save the device index which is pointing to a struct inside the > now allocated and freed memory resulting in garbage getting returned > in some cases. > > Fix by using a stack variable to save the return value and only set > it to ifi->ifi_index after all checks are done and before the answer > buffer is freed. > > Fixes: 86bf43c7c2fdc ("lib/libnetlink: update rtnl_talk to support malloc buff at run time") > Cc: Hangbin Liu <liuhangbin@gmail.com> > Cc: Phil Sutter <phil@nwl.cc> > Signed-off-by: David Ahern <dsahern@gmail.com> > --- > ip/iplink_vrf.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/ip/iplink_vrf.c b/ip/iplink_vrf.c > index e9dd0df98412..6004bb4f305e 100644 > --- a/ip/iplink_vrf.c > +++ b/ip/iplink_vrf.c > @@ -191,6 +191,7 @@ int name_is_vrf(const char *name) > struct rtattr *tb[IFLA_MAX+1]; > struct rtattr *li[IFLA_INFO_MAX+1]; > struct ifinfomsg *ifi; > + int ifindex = 0; > int len; > > addattr_l(&req.n, sizeof(req), IFLA_IFNAME, name, strlen(name) + 1); > @@ -218,7 +219,8 @@ int name_is_vrf(const char *name) > if (strcmp(RTA_DATA(li[IFLA_INFO_KIND]), "vrf")) > goto out; > > + ifindex = ifi->ifi_index; > out: > free(answer); > - return ifi->ifi_index; > + return ifindex; > } > -- > 2.11.0 > Thanks for the fix. Acked-by: Hangbin Liu <liuhangbin@gmail.com>
diff --git a/ip/iplink_vrf.c b/ip/iplink_vrf.c index e9dd0df98412..6004bb4f305e 100644 --- a/ip/iplink_vrf.c +++ b/ip/iplink_vrf.c @@ -191,6 +191,7 @@ int name_is_vrf(const char *name) struct rtattr *tb[IFLA_MAX+1]; struct rtattr *li[IFLA_INFO_MAX+1]; struct ifinfomsg *ifi; + int ifindex = 0; int len; addattr_l(&req.n, sizeof(req), IFLA_IFNAME, name, strlen(name) + 1); @@ -218,7 +219,8 @@ int name_is_vrf(const char *name) if (strcmp(RTA_DATA(li[IFLA_INFO_KIND]), "vrf")) goto out; + ifindex = ifi->ifi_index; out: free(answer); - return ifi->ifi_index; + return ifindex; }