Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02c00c2a authored by Jon Paul Maloy's avatar Jon Paul Maloy Committed by David S. Miller
Browse files

tipc: fix potential bug in function tipc_backlog_rcv 



In commit 4f4482dc ("tipc: compensate
for double accounting in socket rcv buffer") we access 'truesize' of
a received buffer after it might have been released by the function
filter_rcv().

In this commit we correct this by reading the value of 'truesize' to
the stack before delivering the buffer to filter_rcv().

Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cf97b8ff

net/tipc/socket.c

+3 −2
Original line number Diff line number Diff line
@@ -1431,13 +1431,14 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *buf) 
{

	u32 res;

	struct tipc_sock *tsk = tipc_sk(sk);

	uint truesize = buf->truesize;



	res = filter_rcv(sk, buf);

	if (unlikely(res))

		tipc_reject_msg(buf, res);



	if (atomic_read(&tsk->dupl_rcvcnt) < TIPC_CONN_OVERLOAD_LIMIT)

		atomic_add(buf->truesize, &tsk->dupl_rcvcnt);

		atomic_add(truesize, &tsk->dupl_rcvcnt);



	return 0;

}