When tcf_em_tree_dump() was converted from the legacy rtnetlink
`RTA_PUT_NOHDR` macro (which contained an implicit `goto
rtattr_failure;`) to `nla_put_nohdr()`, the return value check on
`nla_put_nohdr()` was omitted for container/simple matches and raw match
payloads.
If the netlink dump skb runs out of tailroom at `nla_put_nohdr()`, the
error is silently ignored and `match_start->nla_len` is finalized
without the match payload, emitting a malformed/truncated
TCA_EMATCH_TREE_LIST attribute to userspace instead of returning `-1`
via `nla_put_failure` so rtnetlink can reallocate and retry the dump.
Check the return value of `nla_put_nohdr()` in both branches and jump to
`nla_put_failure` on error.
Fixes: add93b610a4e ("[NET_SCHED]: Convert classifiers from rtnetlink to new netlink API")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
net/sched/ematch.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 5c1235e6076a..563feb1011f2 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -470,9 +470,12 @@ int tcf_em_tree_dump(struct sk_buff *skb, struct tcf_ematch_tree *tree, int tlv)
goto nla_put_failure;
} else if (tcf_em_is_container(em) || tcf_em_is_simple(em)) {
u32 u = em->data;
- nla_put_nohdr(skb, sizeof(u), &u);
- } else if (em->datalen > 0)
- nla_put_nohdr(skb, em->datalen, (void *) em->data);
+ if (nla_put_nohdr(skb, sizeof(u), &u))
+ goto nla_put_failure;
+ } else if (em->datalen > 0) {
+ if (nla_put_nohdr(skb, em->datalen, (void *)em->data))
+ goto nla_put_failure;
+ }
tail = skb_tail_pointer(skb);
match_start->nla_len = tail - (u8 *)match_start;
--
2.55.0.1082.g2b9226bbc0-goog