hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tipc: move premature initilalization of stack variables 

In the function tipc_rcv() we initialize a couple of stack variables
from the message header before that same header has been validated.
In rare cases when the arriving header is non-linar, the validation
function itself may linearize the buffer by calling skb_may_pull(),
while the wrongly initialized stack fields are not updated accordingly.

We fix this in this commit.

Reported-by: Matthew Wong <mwong@sonusnet.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jon Paul Maloy 2017-02-23 11:10:31 -05:00 committed by David S. Miller
parent fbf68229ff
commit 681a55d717
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/tipc/node.c
View File

@ -1505,19 +1505,21 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
{ {
struct sk_buff_head xmitq; struct sk_buff_head xmitq;
struct tipc_node *n; struct tipc_node *n;
struct tipc_msg *hdr = buf_msg(skb); struct tipc_msg *hdr;
int usr = msg_user(hdr);
int bearer_id = b->identity; int bearer_id = b->identity;
struct tipc_link_entry *le; struct tipc_link_entry *le;
u16 bc_ack = msg_bcast_ack(hdr);
u32 self = tipc_own_addr(net); u32 self = tipc_own_addr(net);
int rc = 0; int usr, rc = 0;
u16 bc_ack;
__skb_queue_head_init(&xmitq); __skb_queue_head_init(&xmitq);
/* Ensure message is well-formed */ /* Ensure message is well-formed before touching the header */
if (unlikely(!tipc_msg_validate(skb))) if (unlikely(!tipc_msg_validate(skb)))
goto discard; goto discard;
hdr = buf_msg(skb);
usr = msg_user(hdr);
bc_ack = msg_bcast_ack(hdr);
/* Handle arrival of discovery or broadcast packet */ /* Handle arrival of discovery or broadcast packet */
if (unlikely(msg_non_seq(hdr))) { if (unlikely(msg_non_seq(hdr))) {