Subject: Re: [PATCH] TIPC: Fix infinite loop in netlink handler

From: Patrick McHardy <[email-masked]>
Date: Tue, 19 Jun 2007 23:32:47 +0200

Florian Westphal wrote:
> From: Florian Westphal <[email-masked]>
> 
> The tipc netlink config handler uses the nlmsg_pid from the
> request header as destination for its reply. If the application
> initialized nlmsg_pid to 0, the reply is looped back to the kernel,
> causing hangup. Fix: use nlmsg_pid of the skb that triggered the
> request.
> 
> -		genlmsg_unicast(rep_buf, req_nlh->nlmsg_pid);
> +		genlmsg_unicast(rep_buf, NETLINK_CB(skb).pid);

This is the second time we're seeing this bug within a few weeks,
maybe we should rename NETLINK_CB(skb).pid to dst_pid to avoid
similar confusion in the future? We could even rename nlmsg_pid
to nlmsg_src within the kernel, which should make it completely
clear what is being refered to.