Commit ef283814 authored Mar 08, 2022 by Tung Nguyen Committed by Lee Jones Nov 22, 2022

BACKPORT: tipc: fix incorrect order of state message data sanity check



When receiving a state message, function tipc_link_validate_msg()
is called to validate its header portion. Then, its data portion
is validated before it can be accessed correctly. However, current
data sanity  check is done after the message header is accessed to
update some link variables.

This commit fixes this issue by moving the data sanity check to
the beginning of state message handling and right after the header
sanity check.

Bug: 254441685
Fixes: 9aa422ad3266 ("tipc: improve size validations for received domain records")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Link: https://lore.kernel.org/r/20220308021200.9245-1-tung.q.nguyen@dektech.com.au


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit c79fcc27be90b308b3fa90811aefafdd4078668c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: If6cff72e268879445b388c957810263c59488718

parent c5f9da53

net/tipc/link.c

+11 −10

Original line number	Diff line number	Diff line
		@@ -2033,6 +2033,17 @@ static int tipc_link_proto_rcv(struct tipc_link l, struct sk_buff skb,
		break;

		case STATE_MSG:
		/* Receive Gap ACK blocks from peer if any */
		if (l->peer_caps & TIPC_GAP_ACK_BLOCK) {
		ga = (struct tipc_gap_ack_blks *)data;
		glen = ntohs(ga->len);
		/* sanity check: if failed, ignore Gap ACK blocks */
		if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
		ga = NULL;
		}
		if(glen > dlen)
		break;

		l->rcv_nxt_state = msg_seqno(hdr) + 1;

		/* Update own tolerance if peer indicates a non-zero value */
		@@ -2058,16 +2069,6 @@ static int tipc_link_proto_rcv(struct tipc_link l, struct sk_buff skb,
		break;
		}

		/* Receive Gap ACK blocks from peer if any */
		if (l->peer_caps & TIPC_GAP_ACK_BLOCK) {
		ga = (struct tipc_gap_ack_blks *)data;
		glen = ntohs(ga->len);
		/* sanity check: if failed, ignore Gap ACK blocks */
		if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
		ga = NULL;
		}
		if(glen > dlen)
		break;
		tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,
		&l->mon_state, l->bearer_id);