libnetlink: fix leak and using unused memory on error

If an error happens in multi-segment message (tc only)
then report the error and stop processing further responses.
This also fixes refering to the buffer after free.

The sequence check is not necessary here because the
response message has already been validated to be in
the window of the sequence number of the iov.

Reported-by: Mahesh Bandewar <mahesh@bandewar.net>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Mahesh Bandewar <maheshb@google.com>

diff --git a/lib/libnetlink.c b/lib/libnetlink.c
index 928de1dd16d84b7802c06d0a659f5d73e1bbcb4b..586809292594660be15296010440392bb0dc3ce5 100644 (file)
--- a/lib/libnetlink.c
+++ b/lib/libnetlink.c
@@ -617,7 +617,6 @@ static int __rtnl_talk_iov(struct rtnl_handle *rtnl, struct iovec *iov,
        msg.msg_iovlen = 1;
        i = 0;
        while (1) {
-next:
                status = rtnl_recvmsg(rtnl->fd, &msg, &buf);
                ++i;
 
@@ -660,27 +659,23 @@ next:
 
                                if (l < sizeof(struct nlmsgerr)) {
                                        fprintf(stderr, "ERROR truncated\n");
-                               } else if (!err->error) {
+                                       free(buf);
+                                       return -1;
+                               }
+
+                               if (!err->error)
                                        /* check messages from kernel */
                                        nl_dump_ext_ack(h, errfn);
 
-                                       if (answer)
-                                               *answer = (struct nlmsghdr *)buf;
-                                       else
-                                               free(buf);
-                                       if (h->nlmsg_seq == seq)
-                                               return 0;
-                                       else if (i < iovlen)
-                                               goto next;
-                                       return 0;
-                               }
-
                                if (rtnl->proto != NETLINK_SOCK_DIAG &&
                                    show_rtnl_err)
                                        rtnl_talk_error(h, err, errfn);
 
                                errno = -err->error;
-                               free(buf);
+                               if (answer)
+                                       *answer = (struct nlmsghdr *)buf;
+                               else
+                                       free(buf);
                                return -i;
                        }