ipv6_route_seq_next should increase position index (4fc427e0) · Commits · 戴 / test

if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by:

net/ipv6/ip6_fib.c

+2 −5

Original line number	Diff line number	Diff line
		@@ -2495,14 +2495,13 @@ static void ipv6_route_seq_next(struct seq_file seq, void v, loff_t pos)
		struct net *net = seq_file_net(seq);
		struct ipv6_route_iter *iter = seq->private;

		++(*pos);
		if (!v)
		goto iter_table;

		n = rcu_dereference_bh(((struct fib6_info *)v)->fib6_next);
		if (n) {
		++*pos;
		if (n)
		return n;
		}

		iter_table:
		ipv6_route_check_sernum(iter);
		@@ -2510,8 +2509,6 @@ iter_table:
		r = fib6_walk_continue(&iter->w);
		spin_unlock_bh(&iter->tbl->tb6_lock);
		if (r > 0) {
		if (v)
		++*pos;
		return iter->w.leaf;
		} else if (r < 0) {
		fib6_walker_unlink(net, &iter->w);