Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf2157f8 authored by Jon Paul Maloy's avatar Jon Paul Maloy Committed by David S. Miller
Browse files

tipc: move message validation function to msg.c 



The function link_buf_validate() is in reality re-entrant and context
independent, and will in later commits be called from several locations.
Therefore, we move it to msg.c, make it outline and rename the it to
tipc_msg_validate().

We also redesign the function to make proper use of pskb_may_pull()

Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7764d6e8

net/tipc/link.c

+1 −57
Original line number Diff line number Diff line
@@ -1047,61 +1047,6 @@ static void link_retrieve_defq(struct tipc_link *link, 
		skb_queue_splice_tail_init(&link->deferred_queue, list);

}



/**

 * link_recv_buf_validate - validate basic format of received message

 *

 * This routine ensures a TIPC message has an acceptable header, and at least

 * as much data as the header indicates it should.  The routine also ensures

 * that the entire message header is stored in the main fragment of the message

 * buffer, to simplify future access to message header fields.

 *

 * Note: Having extra info present in the message header or data areas is OK.

 * TIPC will ignore the excess, under the assumption that it is optional info

 * introduced by a later release of the protocol.

 */

static int link_recv_buf_validate(struct sk_buff *buf)

{

	static u32 min_data_hdr_size[8] = {

		SHORT_H_SIZE, MCAST_H_SIZE, NAMED_H_SIZE, BASIC_H_SIZE,

		MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE, MAX_H_SIZE

		};



	struct tipc_msg *msg;

	u32 tipc_hdr[2];

	u32 size;

	u32 hdr_size;

	u32 min_hdr_size;



	/* If this packet comes from the defer queue, the skb has already

	 * been validated

	 */

	if (unlikely(TIPC_SKB_CB(buf)->deferred))

		return 1;



	if (unlikely(buf->len < MIN_H_SIZE))

		return 0;



	msg = skb_header_pointer(buf, 0, sizeof(tipc_hdr), tipc_hdr);

	if (msg == NULL)

		return 0;



	if (unlikely(msg_version(msg) != TIPC_VERSION))

		return 0;



	size = msg_size(msg);

	hdr_size = msg_hdr_sz(msg);

	min_hdr_size = msg_isdata(msg) ?

		min_data_hdr_size[msg_type(msg)] : INT_H_SIZE;



	if (unlikely((hdr_size < min_hdr_size) ||

		     (size < hdr_size) ||

		     (buf->len < size) ||

		     (size - hdr_size > TIPC_MAX_USER_MSG_SIZE)))

		return 0;



	return pskb_may_pull(buf, hdr_size);

}



/**

 * tipc_rcv - process TIPC packets/messages arriving from off-node

 * @net: the applicable net namespace
@@ -1127,7 +1072,7 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b_ptr) 


	while ((skb = __skb_dequeue(&head))) {

		/* Ensure message is well-formed */

		if (unlikely(!link_recv_buf_validate(skb)))

		if (unlikely(!tipc_msg_validate(skb)))

			goto discard;



		/* Ensure message data is a single contiguous unit */
@@ -1398,7 +1343,6 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr, 


	if (tipc_link_defer_pkt(&l_ptr->deferred_queue, buf)) {

		l_ptr->stats.deferred_recv++;

		TIPC_SKB_CB(buf)->deferred = true;

		if ((skb_queue_len(&l_ptr->deferred_queue) % 16) == 1)

			tipc_link_proto_xmit(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);

	} else {

net/tipc/msg.c

+43 −1
Original line number Diff line number Diff line 
/*

 * net/tipc/msg.c: TIPC message header routines

 *

 * Copyright (c) 2000-2006, 2014, Ericsson AB

 * Copyright (c) 2000-2006, 2014-2015, Ericsson AB

 * Copyright (c) 2005, 2010-2011, Wind River Systems

 * All rights reserved.

 *
@@ -181,6 +181,48 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) 
	return 0;

}



/* tipc_msg_validate - validate basic format of received message

 *

 * This routine ensures a TIPC message has an acceptable header, and at least

 * as much data as the header indicates it should.  The routine also ensures

 * that the entire message header is stored in the main fragment of the message

 * buffer, to simplify future access to message header fields.

 *

 * Note: Having extra info present in the message header or data areas is OK.

 * TIPC will ignore the excess, under the assumption that it is optional info

 * introduced by a later release of the protocol.

 */

bool tipc_msg_validate(struct sk_buff *skb)

{

	struct tipc_msg *msg;

	int msz, hsz;



	if (unlikely(TIPC_SKB_CB(skb)->validated))

		return true;

	if (unlikely(!pskb_may_pull(skb, MIN_H_SIZE)))

		return false;



	hsz = msg_hdr_sz(buf_msg(skb));

	if (unlikely(hsz < MIN_H_SIZE) || (hsz > MAX_H_SIZE))

		return false;

	if (unlikely(!pskb_may_pull(skb, hsz)))

		return false;



	msg = buf_msg(skb);

	if (unlikely(msg_version(msg) != TIPC_VERSION))

		return false;



	msz = msg_size(msg);

	if (unlikely(msz < hsz))

		return false;

	if (unlikely((msz - hsz) > TIPC_MAX_USER_MSG_SIZE))

		return false;

	if (unlikely(skb->len < msz))

		return false;



	TIPC_SKB_CB(skb)->validated = true;

	return true;

}



/**

 * tipc_msg_build - create buffer chain containing specified header and data

net/tipc/msg.h

+3 −2
Original line number Diff line number Diff line 
/*

 * net/tipc/msg.h: Include file for TIPC message header routines

 *

 * Copyright (c) 2000-2007, 2014, Ericsson AB

 * Copyright (c) 2000-2007, 2014-2015 Ericsson AB

 * Copyright (c) 2005-2008, 2010-2011, Wind River Systems

 * All rights reserved.

 *
@@ -92,7 +92,7 @@ struct plist; 
struct tipc_skb_cb {

	void *handle;

	struct sk_buff *tail;

	bool deferred;

	bool validated;

	bool wakeup_pending;

	bool bundling;

	u16 chain_sz;
@@ -758,6 +758,7 @@ static inline u32 msg_tot_origport(struct tipc_msg *m) 
}



struct sk_buff *tipc_buf_acquire(u32 size);

bool tipc_msg_validate(struct sk_buff *skb);

bool tipc_msg_reverse(u32 own_addr, struct sk_buff *buf, u32 *dnode,

		      int err);

void tipc_msg_init(u32 own_addr, struct tipc_msg *m, u32 user, u32 type,