As msgbuff_append() only copies protocol payload, i.e. part of the buffer
without netlink and genetlink header, and mnl_nlmsg_get_payload_len() only
subtracts netlink header length, we need to subtract genetlink header
length manually to get correct length of appended data block.

Fixes: 5050607946b6 ("netlink: message buffer and composition helpers")
Reported-by: Andrew Lunn <and...@lunn.ch>
Signed-off-by: Michal Kubecek <mkube...@suse.cz>
---
 netlink/msgbuff.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/netlink/msgbuff.c b/netlink/msgbuff.c
index 74065709ef7d..216f5b946236 100644
--- a/netlink/msgbuff.c
+++ b/netlink/msgbuff.c
@@ -79,6 +79,7 @@ int msgbuff_append(struct nl_msg_buff *dest, struct 
nl_msg_buff *src)
        unsigned int dest_len = MNL_ALIGN(msgbuff_len(dest));
        int ret;
 
+       src_len -= GENL_HDRLEN;
        ret = msgbuff_realloc(dest, dest_len + src_len);
        if (ret < 0)
                return ret;
-- 
2.26.2

Reply via email to