| From foo@baz Sun Nov 22 12:00:04 PM CET 2020 |
| From: Wang Hai <wanghai38@huawei.com> |
| Date: Mon, 16 Nov 2020 16:20:18 +0800 |
| Subject: inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() |
| |
| From: Wang Hai <wanghai38@huawei.com> |
| |
| [ Upstream commit e33de7c5317e2827b2ba6fd120a505e9eb727b05 ] |
| |
| nlmsg_cancel() needs to be called in the error path of |
| inet_req_diag_fill to cancel the message. |
| |
| Fixes: d545caca827b ("net: inet: diag: expose the socket mark to privileged processes.") |
| Reported-by: Hulk Robot <hulkci@huawei.com> |
| Signed-off-by: Wang Hai <wanghai38@huawei.com> |
| Link: https://lore.kernel.org/r/20201116082018.16496-1-wanghai38@huawei.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ipv4/inet_diag.c | 4 +++- |
| 1 file changed, 3 insertions(+), 1 deletion(-) |
| |
| --- a/net/ipv4/inet_diag.c |
| +++ b/net/ipv4/inet_diag.c |
| @@ -392,8 +392,10 @@ static int inet_req_diag_fill(struct soc |
| r->idiag_inode = 0; |
| |
| if (net_admin && nla_put_u32(skb, INET_DIAG_MARK, |
| - inet_rsk(reqsk)->ir_mark)) |
| + inet_rsk(reqsk)->ir_mark)) { |
| + nlmsg_cancel(skb, nlh); |
| return -EMSGSIZE; |
| + } |
| |
| nlmsg_end(skb, nlh); |
| return 0; |