tipc: reassign pointers after skb reallocation / linearization (60d1d936) · Commits · 戴 / test

In tipc_msg_reverse(), we assign skb attributes to local pointers in stack at startup. This is followed by skb_linearize() and for cloned buffers we perform skb relocation using pskb_expand_head(). Both these methods may update the skb attributes and thus making the pointers incorrect. In this commit, we fix this error by ensuring that the pointers are re-assigned after any of these skb operations. Fixes: ("tipc: let function tipc_msg_reverse() expand header when needed") Signed-off-by:

Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Reviewed-by:

Jon Maloy <jon.maloy@ericsson.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/tipc/msg.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -479,13 +479,14 @@ bool tipc_msg_make_bundle(struct sk_buff *skb, struct tipc_msg msg,
		bool tipc_msg_reverse(u32 own_node, struct sk_buff **skb, int err)
		{
		struct sk_buff _skb = skb;
		struct tipc_msg *hdr = buf_msg(_skb);
		struct tipc_msg *hdr;
		struct tipc_msg ohdr;
		int dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);
		int dlen;

		if (skb_linearize(_skb))
		goto exit;
		hdr = buf_msg(_skb);
		dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);
		if (msg_dest_droppable(hdr))
		goto exit;
		if (msg_errcode(hdr))
		@@ -511,6 +512,8 @@ bool tipc_msg_reverse(u32 own_node, struct sk_buff **skb, int err)
		pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
		goto exit;

		/* reassign after skb header modifications */
		hdr = buf_msg(_skb);
		/* Now reverse the concerned fields */
		msg_set_errcode(hdr, err);
		msg_set_non_seq(hdr, 0);

Admin message