50 lines
2.7 KiB
Diff
50 lines
2.7 KiB
Diff
|
From 8e4576b9fdb5c888d20a13aa2cc198df790dba54 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Thomas Haller <thaller@redhat.com>
|
||
|
|
Date: Fri, 18 Jul 2014 13:34:33 +0200
|
||
|
|
Subject: netlink: fix crash in netlink-monitor validating netlink messages
|
||
|
|
|
||
|
|
The wrong callback data pointer was passed to the netlink message
|
||
|
|
validation function.
|
||
|
|
|
||
|
|
Since libnl commit 4dd5fdd0af2c0b7ffe1dbc49313f263dbb2e906f,
|
||
|
|
nl_socket_get_local_port() actually modifes the provided @sk
|
||
|
|
pointer. Hence, since libnl 3.2.25 NM will crash due to
|
||
|
|
this bug.
|
||
|
|
|
||
|
|
#0 _nl_socket_generate_local_port_no_release (sk=0x715500) at socket.c:339
|
||
|
|
#1 0x00007ffff76f3ad5 in nl_socket_get_local_port (sk=sk@entry=0x715500) at socket.c:369
|
||
|
|
#2 0x000000000046b81a in event_msg_recv (msg=<optimized out>, arg=0x715500) at nm-netlink-monitor.c:204
|
||
|
|
#3 0x00007ffff76f2604 in nl_cb_call (msg=0x71f240, type=5, cb=0x71f150) at ../include/netlink-private/netlink.h:141
|
||
|
|
#4 recvmsgs (cb=0x71f150, sk=0x71f070) at nl.c:823
|
||
|
|
#5 nl_recvmsgs_report (sk=sk@entry=0x71f070, cb=cb@entry=0x71f150) at nl.c:1003
|
||
|
|
#6 0x00007ffff76f2bc9 in nl_recvmsgs (sk=sk@entry=0x71f070, cb=cb@entry=0x71f150) at nl.c:1027
|
||
|
|
#7 0x00007ffff76ec6b8 in __cache_pickup (sk=sk@entry=0x71f070, cache=cache@entry=0x71f0c0, param=param@entry=0x7fffffffd3f0) at cache.c:701
|
||
|
|
#8 0x00007ffff76ed0dd in nl_cache_pickup (sk=sk@entry=0x71f070, cache=cache@entry=0x71f0c0) at cache.c:753
|
||
|
|
#9 0x00007ffff76ed2d8 in nl_cache_refill (sk=sk@entry=0x71f070, cache=cache@entry=0x71f0c0) at cache.c:983
|
||
|
|
#10 0x00007ffff7b224db in rtnl_link_alloc_cache (sk=0x71f070, family=family@entry=0, result=result@entry=0x7154e0) at route/link.c:1029
|
||
|
|
#11 0x000000000046c5f7 in sync_connection_setup (self=self@entry=0x715500, error=error@entry=0x7fffffffd4f8) at nm-netlink-monitor.c:412
|
||
|
|
#12 0x000000000046c91f in nm_netlink_monitor_open_connection (self=0x715500, error=error@entry=0x7fffffffd4f8) at nm-netlink-monitor.c:447
|
||
|
|
#13 0x000000000046cad7 in nm_netlink_monitor_get () at nm-netlink-monitor.c:840
|
||
|
|
#14 0x00000000004558b9 in main (argc=1, argv=0x7fffffffd958) at main.c:527
|
||
|
|
|
||
|
|
Reported-by: Jan Engelhardt <jengelh@inai.de>
|
||
|
|
Fixes: 9fee99e1230580067efb33f3aaea0fddad5cfe66
|
||
|
|
Signed-off-by: Thomas Haller <thaller@redhat.com>
|
||
|
|
|
||
|
|
diff --git a/src/nm-netlink-monitor.c b/src/nm-netlink-monitor.c
|
||
|
|
index ba8053e..593dec9 100644
|
||
|
|
--- a/src/nm-netlink-monitor.c
|
||
|
|
+++ b/src/nm-netlink-monitor.c
|
||
|
|
@@ -285,7 +285,7 @@ nlh_setup (struct nl_sock *nlh,
|
||
|
|
{
|
||
|
|
int err;
|
||
|
|
|
||
|
|
- nl_socket_modify_cb (nlh, NL_CB_MSG_IN, NL_CB_CUSTOM, event_msg_recv, cb_data);
|
||
|
|
+ nl_socket_modify_cb (nlh, NL_CB_MSG_IN, NL_CB_CUSTOM, event_msg_recv, nlh);
|
||
|
|
|
||
|
|
if (valid_func)
|
||
|
|
nl_socket_modify_cb (nlh, NL_CB_VALID, NL_CB_CUSTOM, valid_func, cb_data);
|
||
|
|
--
|
||
|
|
cgit v0.10.2
|
||
|
|
|