tipc: move premature initilalization of stack variables (681a55d7) · Commits · 戴 / test

In the function tipc_rcv() we initialize a couple of stack variables from the message header before that same header has been validated. In rare cases when the arriving header is non-linar, the validation function itself may linearize the buffer by calling skb_may_pull(), while the wrongly initialized stack fields are not updated accordingly. We fix this in this commit. Reported-by:

Matthew Wong <mwong@sonusnet.com> Signed-off-by:

Jon Maloy <jon.maloy@ericsson.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/tipc/node.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -1505,19 +1505,21 @@ void tipc_rcv(struct net net, struct sk_buff skb, struct tipc_bearer *b)
		{
		struct sk_buff_head xmitq;
		struct tipc_node *n;
		struct tipc_msg *hdr = buf_msg(skb);
		int usr = msg_user(hdr);
		struct tipc_msg *hdr;
		int bearer_id = b->identity;
		struct tipc_link_entry *le;
		u16 bc_ack = msg_bcast_ack(hdr);
		u32 self = tipc_own_addr(net);
		int rc = 0;
		int usr, rc = 0;
		u16 bc_ack;

		__skb_queue_head_init(&xmitq);

		/* Ensure message is well-formed */
		/* Ensure message is well-formed before touching the header */
		if (unlikely(!tipc_msg_validate(skb)))
		goto discard;
		hdr = buf_msg(skb);
		usr = msg_user(hdr);
		bc_ack = msg_bcast_ack(hdr);

		/* Handle arrival of discovery or broadcast packet */
		if (unlikely(msg_non_seq(hdr))) {

Admin message