Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 681a55d7 authored by Jon Paul Maloy's avatar Jon Paul Maloy Committed by David S. Miller
Browse files

tipc: move premature initilalization of stack variables 



In the function tipc_rcv() we initialize a couple of stack variables
from the message header before that same header has been validated.
In rare cases when the arriving header is non-linar, the validation
function itself may linearize the buffer by calling skb_may_pull(),
while the wrongly initialized stack fields are not updated accordingly.

We fix this in this commit.

Reported-by: default avatarMatthew Wong <mwong@sonusnet.com>
Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fbf68229

net/tipc/node.c

+7 −5
Original line number Diff line number Diff line
@@ -1505,19 +1505,21 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b) 
{

	struct sk_buff_head xmitq;

	struct tipc_node *n;

	struct tipc_msg *hdr = buf_msg(skb);

	int usr = msg_user(hdr);

	struct tipc_msg *hdr;

	int bearer_id = b->identity;

	struct tipc_link_entry *le;

	u16 bc_ack = msg_bcast_ack(hdr);

	u32 self = tipc_own_addr(net);

	int rc = 0;

	int usr, rc = 0;

	u16 bc_ack;



	__skb_queue_head_init(&xmitq);



	/* Ensure message is well-formed */

	/* Ensure message is well-formed before touching the header */

	if (unlikely(!tipc_msg_validate(skb)))

		goto discard;

	hdr = buf_msg(skb);

	usr = msg_user(hdr);

	bc_ack = msg_bcast_ack(hdr);



	/* Handle arrival of discovery or broadcast packet */

	if (unlikely(msg_non_seq(hdr))) {