• Julius Volz's avatar
    net/wireless/nl80211.c: fix endless Netlink callback loop. · b4637271
    Julius Volz authored
    Although I only tested similar code (I don't use any of this wireless
    code), the state maintainance between Netlink dump callback invocations
    seems wrong here and should lead to an endless loop. There are also other
    examples in the same file which might have the same problem. Perhaps someone
    can actually test this (or refute my logic).
    
    Take the simple example with only one element in the list (which should fit
    into the message):
    
    1. invocation:
      Start:
        idx = 0, start = 0
      Loop:
        condition (++idx < start) => (1 < 0) => false
        => no continue, fill one entry, exit loop, return skb->len > 0
    
    2. invocation:
      Start:
        idx = 0, start = 1
      Loop:
        condition (++idx < start) => (1 < 1) => false
        => no continue, fill the same entry again, exit loop, return skb->len > 0
    
    3. invocation:
      Same as 2. invocation, endless invocation of callback.
    
    Also, iterations where the filling of an element fails should not be counted as
    completed, so idx should not be incremented in this case.
    Signed-off-by: default avatarJulius Volz <juliusv@google.com>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    b4637271
nl80211.c 37.3 KB