tcf_action_fill_size() already computes the required dump size, but RTM_GETACTION replies always allocate NLMSG_GOODSIZE. Large action state can overrun that skb and make dumps fail. Use the computed reply size for RTM_GETACTION replies so large actions can be dumped, while still keeping NLMSG_GOODSIZE as a floor. Fixes: 4e76e75d6aba ("net sched actions: calculate add/delete event message size") Cc: stable@vger.kernel.org Signed-off-by: Paul Moses --- net/sched/act_api.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/sched/act_api.c b/net/sched/act_api.c index e1ab0faeb8113..8ab016d352850 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -1685,12 +1685,12 @@ static int tca_get_fill(struct sk_buff *skb, struct tc_action *actions[], static int tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n, - struct tc_action *actions[], int event, + struct tc_action *actions[], int event, size_t attr_size, struct netlink_ext_ack *extack) { struct sk_buff *skb; - skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); + skb = alloc_skb(max_t(size_t, attr_size, NLMSG_GOODSIZE), GFP_KERNEL); if (!skb) return -ENOBUFS; if (tca_get_fill(skb, actions, portid, n->nlmsg_seq, 0, event, @@ -2041,7 +2041,8 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n, attr_size = tcf_action_full_attrs_size(attr_size); if (event == RTM_GETACTION) - ret = tcf_get_notify(net, portid, n, actions, event, extack); + ret = tcf_get_notify(net, portid, n, actions, event, + attr_size, extack); else { /* delete */ ret = tcf_del_notify(net, n, actions, portid, attr_size, extack); if (ret) -- 2.52.GIT