tipc: don't sanity check non-existing TLV (NL compat)
authorRichard Alpe <richard.alpe@ericsson.com>
Mon, 17 Aug 2015 12:15:10 +0000 (14:15 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 17 Aug 2015 17:39:54 +0000 (10:39 -0700)
A zero length payload means that no TLV (Type Length Value) data has
been passed. Prior to this patch a non-existing TLV could be sanity
checked with TLV_OK() resulting in random behavior where a user
sending an empty message occasionally got a incorrect "operation not
supported" message back.

Signed-off-by: Richard Alpe <richard.alpe@ericsson.com>
Reviewed-by: Erik Hugne <erik.hugne@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/netlink_compat.c

index 53e0fee800864e4b8c29ed793d60a5823d59c773..1eadc95e113294c159a6e5288db831e142be77dc 100644 (file)
@@ -1114,7 +1114,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
        }
 
        len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
-       if (TLV_GET_LEN(msg.req) && !TLV_OK(msg.req, len)) {
+       if (len && !TLV_OK(msg.req, len)) {
                msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
                err = -EOPNOTSUPP;
                goto send;