summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJulius Volz <juliusv@google.com>2008-07-08 14:02:19 +0200
committerJohn W. Linville <linville@tuxdriver.com>2008-07-08 20:16:08 +0200
commitb46372710ab536c0967f76be5dc41341583d4a54 (patch)
tree6cbf00e9246943306d9185267e783684a68dc27d
parentrtl8187: Change detection of RTL8187B with USB ID of 8187 (diff)
downloadlinux-b46372710ab536c0967f76be5dc41341583d4a54.tar.xz
linux-b46372710ab536c0967f76be5dc41341583d4a54.zip
net/wireless/nl80211.c: fix endless Netlink callback loop.
Although I only tested similar code (I don't use any of this wireless code), the state maintainance between Netlink dump callback invocations seems wrong here and should lead to an endless loop. There are also other examples in the same file which might have the same problem. Perhaps someone can actually test this (or refute my logic). Take the simple example with only one element in the list (which should fit into the message): 1. invocation: Start: idx = 0, start = 0 Loop: condition (++idx < start) => (1 < 0) => false => no continue, fill one entry, exit loop, return skb->len > 0 2. invocation: Start: idx = 0, start = 1 Loop: condition (++idx < start) => (1 < 1) => false => no continue, fill the same entry again, exit loop, return skb->len > 0 3. invocation: Same as 2. invocation, endless invocation of callback. Also, iterations where the filling of an element fails should not be counted as completed, so idx should not be incremented in this case. Signed-off-by: Julius Volz <juliusv@google.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--net/wireless/nl80211.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index fb75f265b39c..b7fefffd2d0d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -199,12 +199,14 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
mutex_lock(&cfg80211_drv_mutex);
list_for_each_entry(dev, &cfg80211_drv_list, list) {
- if (++idx < start)
+ if (++idx <= start)
continue;
if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
cb->nlh->nlmsg_seq, NLM_F_MULTI,
- dev) < 0)
+ dev) < 0) {
+ idx--;
break;
+ }
}
mutex_unlock(&cfg80211_drv_mutex);