Skip to content

Commit

Permalink
tipc: check return value of __tipc_dump_start()
Browse files Browse the repository at this point in the history
When __tipc_dump_start() fails with running out of memory,
we have no reason to continue, especially we should avoid
calling tipc_dump_done().

Fixes: 8f5c5fc ("tipc: call start and done ops directly in __tipc_nl_compat_dumpit()")
Reported-and-tested-by: syzbot+3f8324abccfbf8c74a9f@syzkaller.appspotmail.com
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Cong Wang authored and David S. Miller committed Sep 12, 2018
1 parent 6b4d24d commit 12a78b0
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion net/tipc/netlink_compat.c
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
return -ENOMEM;

buf->sk = msg->dst_sk;
__tipc_dump_start(&cb, msg->net);
if (__tipc_dump_start(&cb, msg->net)) {
kfree_skb(buf);
return -ENOMEM;
}

do {
int rem;
Expand Down

0 comments on commit 12a78b0

Please sign in to comment.