Commit a9e2971b authored Oct 07, 2017 by Jon Maloy Committed by David S. Miller Oct 08, 2017

tipc: Unclone message at secondary destination lookup



When a bundling message is received, the function tipc_link_input()
calls function tipc_msg_extract() to unbundle all inner messages of
the bundling message before adding them to input queue.

The function tipc_msg_extract() just clones all inner skb for all
inner messagges from the bundling skb. This means that the skb
headroom of an inner message overlaps with the data part of the
preceding message in the bundle.

If the message in question is a name addressed message, it may be
subject to a secondary destination lookup, and eventually be sent out
on one of the interfaces again. But, since what is perceived as headroom
by the device driver in reality is the last bytes of the preceding
message in the bundle, the latter will be overwritten by the MAC
addresses of the L2 header. If the preceding message has not yet been
consumed by the user, it will evenually be delivered with corrupted
contents.

This commit fixes this by uncloning all messages passing through the
function tipc_msg_lookup_dest(), hence ensuring that the headroom
is always valid when the message is passed on.

Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 3382605f

net/tipc/msg.c

+8 −0

Original line number	Original line	Diff line number	Diff line
	@@ -568,6 +568,14 @@ bool tipc_msg_lookup_dest(struct net net, struct sk_buff skb, int *err)
	msg_set_destnode(msg, dnode);		msg_set_destnode(msg, dnode);
	msg_set_destport(msg, dport);		msg_set_destport(msg, dport);
	*err = TIPC_OK;		*err = TIPC_OK;

			if (!skb_cloned(skb))
			return true;

			/* Unclone buffer in case it was bundled */
			if (pskb_expand_head(skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
			return false;

	return true;		return true;
	}		}

Admin message