Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 60d1d936 authored by Parthasarathy Bhuvaragan's avatar Parthasarathy Bhuvaragan Committed by David S. Miller
Browse files

tipc: reassign pointers after skb reallocation / linearization 



In tipc_msg_reverse(), we assign skb attributes to local pointers
in stack at startup. This is followed by skb_linearize() and for
cloned buffers we perform skb relocation using pskb_expand_head().
Both these methods may update the skb attributes and thus making
the pointers incorrect.

In this commit, we fix this error by ensuring that the pointers
are re-assigned after any of these skb operations.

Fixes: 29042e19 ("tipc: let function tipc_msg_reverse() expand header
when needed")
Signed-off-by: default avatarParthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Reviewed-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 27163138

net/tipc/msg.c

+5 −2
Original line number Diff line number Diff line
@@ -479,13 +479,14 @@ bool tipc_msg_make_bundle(struct sk_buff **skb, struct tipc_msg *msg, 
bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)

{

	struct sk_buff *_skb = *skb;

	struct tipc_msg *hdr = buf_msg(_skb);

	struct tipc_msg *hdr;

	struct tipc_msg ohdr;

	int dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);

	int dlen;



	if (skb_linearize(_skb))

		goto exit;

	hdr = buf_msg(_skb);

	dlen = min_t(uint, msg_data_sz(hdr), MAX_FORWARD_SIZE);

	if (msg_dest_droppable(hdr))

		goto exit;

	if (msg_errcode(hdr))
@@ -511,6 +512,8 @@ bool tipc_msg_reverse(u32 own_node, struct sk_buff **skb, int err) 
	    pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))

		goto exit;



	/* reassign after skb header modifications */

	hdr = buf_msg(_skb);

	/* Now reverse the concerned fields */

	msg_set_errcode(hdr, err);

	msg_set_non_seq(hdr, 0);