Commit 5cbdbd1a authored by Jon Maloy's avatar Jon Maloy Committed by David S. Miller
Browse files

tipc: refactor function tipc_msg_reverse() 



The function tipc_msg_reverse() is reversing the header of a message
while reusing the original buffer. We have seen at several occasions
that this may have unfortunate side effects when the buffer to be
reversed is a clone.

In one of the following commits we will again need to reverse cloned
buffers, so this is the right time to permanently eliminate this
problem. In this commit we let the said function always consume the
original buffer and replace it with a new one when applicable.

Acked-by: default avatarYing Xue <ying.xue@windriver.com>
Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a337531b

net/tipc/msg.c

+28 −30
Original line number Original line Diff line number Diff line
@@ -499,54 +499,52 @@ bool tipc_msg_make_bundle(struct sk_buff **skb, struct tipc_msg *msg, 
/**

/**

 * tipc_msg_reverse(): swap source and destination addresses and add error code

 * tipc_msg_reverse(): swap source and destination addresses and add error code

 * @own_node: originating node id for reversed message

 * @own_node: originating node id for reversed message

 * @skb:  buffer containing message to be reversed; may be replaced.

 * @skb:  buffer containing message to be reversed; will be consumed

 * @err:  error code to be set in message, if any

 * @err:  error code to be set in message, if any

 * Consumes buffer at failure

 * Replaces consumed buffer with new one when successful

 * Returns true if success, otherwise false

 * Returns true if success, otherwise false

 */

 */

bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)

bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)

{

{

	struct sk_buff *_skb = *skb;

	struct sk_buff *_skb = *skb;

	struct tipc_msg *hdr;

	struct tipc_msg *_hdr, *hdr;

	struct tipc_msg ohdr;

	int hlen, dlen;

	int dlen;





	if (skb_linearize(_skb))

	if (skb_linearize(_skb))

		goto exit;

		goto exit;

	hdr = buf_msg(_skb);

	_hdr = buf_msg(_skb);

	dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);

	dlen = min_t(uint, msg_data_sz(_hdr), MAX_FORWARD_SIZE);

	if (msg_dest_droppable(hdr))

	hlen = msg_hdr_sz(_hdr);



	if (msg_dest_droppable(_hdr))

		goto exit;

		goto exit;

	if (msg_errcode(hdr))

	if (msg_errcode(_hdr))

		goto exit;

		goto exit;





	/* Take a copy of original header before altering message */

	/* Never return SHORT header */

	memcpy(&ohdr, hdr, msg_hdr_sz(hdr));

	if (hlen == SHORT_H_SIZE)

		hlen = BASIC_H_SIZE;





	/* Never return SHORT header; expand by replacing buffer if necessary */

	/* Allocate new buffer to return */

	if (msg_short(hdr)) {

	*skb = tipc_buf_acquire(hlen + dlen, GFP_ATOMIC);

		*skb = tipc_buf_acquire(BASIC_H_SIZE + dlen, GFP_ATOMIC);

	if (!*skb)

	if (!*skb)

		goto exit;

		goto exit;

		memcpy((*skb)->data + BASIC_H_SIZE, msg_data(hdr), dlen);

	memcpy((*skb)->data, _skb->data, msg_hdr_sz(_hdr));

		kfree_skb(_skb);

	memcpy((*skb)->data + hlen, msg_data(_hdr), dlen);

		_skb = *skb;

		hdr = buf_msg(_skb);

		memcpy(hdr, &ohdr, BASIC_H_SIZE);

		msg_set_hdr_sz(hdr, BASIC_H_SIZE);

	}





	/* Now reverse the concerned fields */

	/* Build reverse header in new buffer */

	hdr = buf_msg(*skb);

	msg_set_hdr_sz(hdr, hlen);

	msg_set_errcode(hdr, err);

	msg_set_errcode(hdr, err);

	msg_set_non_seq(hdr, 0);

	msg_set_non_seq(hdr, 0);

	msg_set_origport(hdr, msg_destport(&ohdr));

	msg_set_origport(hdr, msg_destport(_hdr));

	msg_set_destport(hdr, msg_origport(&ohdr));

	msg_set_destport(hdr, msg_origport(_hdr));

	msg_set_destnode(hdr, msg_prevnode(&ohdr));

	msg_set_destnode(hdr, msg_prevnode(_hdr));

	msg_set_prevnode(hdr, own_node);

	msg_set_prevnode(hdr, own_node);

	msg_set_orignode(hdr, own_node);

	msg_set_orignode(hdr, own_node);

	msg_set_size(hdr, msg_hdr_sz(hdr) + dlen);

	msg_set_size(hdr, hlen + dlen);

	skb_trim(_skb, msg_size(hdr));

	skb_orphan(_skb);

	skb_orphan(_skb);

	kfree_skb(_skb);

	return true;

	return true;

exit:

exit:

	kfree_skb(_skb);

	kfree_skb(_skb);

CRA Git | Maintained and supported by SUSTech CRA and CCSE