xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tipc: make tipc_buf_append() more robust

Browse Source 
As per comment from David Miller, we try to make the buffer reassembly
function more resilient to user errors than it is today.

- We check that the "*buf" parameter always is set, since this is
  mandatory input.

- We ensure that *buf->next always is set to NULL before linking in
  the buffer, instead of relying of the caller to have done this.

- We ensure that the "tail" pointer in the head buffer's control
  block is initialized to NULL when the first fragment arrives.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jon Paul Maloy
2014-07-25 14:48:09 -04:00
committed by David S. Miller
parent 3fd0202a0d
commit 13e9b9972f
1 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
net/tipc/msg.c
View File

@@ -72,27 +72,38 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
struct sk_buff *head = *headbuf; struct sk_buff *head = *headbuf;
struct sk_buff *frag = *buf; struct sk_buff *frag = *buf;
struct sk_buff *tail; struct sk_buff *tail;
struct tipc_msg *msg = buf_msg(frag); struct tipc_msg *msg;
u32 fragid = msg_type(msg); u32 fragid;
bool headstolen;
int delta; int delta;
bool headstolen;
if (!frag)
goto err;
msg = buf_msg(frag);
fragid = msg_type(msg);
frag->next = NULL;
skb_pull(frag, msg_hdr_sz(msg)); skb_pull(frag, msg_hdr_sz(msg));
if (fragid == FIRST_FRAGMENT) { if (fragid == FIRST_FRAGMENT) {
if (head || skb_unclone(frag, GFP_ATOMIC)) if (unlikely(head))
goto out_free; goto err;
if (unlikely(skb_unclone(frag, GFP_ATOMIC)))
goto err;
head = *headbuf = frag; head = *headbuf = frag;
skb_frag_list_init(head); skb_frag_list_init(head);
TIPC_SKB_CB(head)->tail = NULL;
*buf = NULL; *buf = NULL;
return 0; return 0;
} }
if (!head) if (!head)
goto out_free; goto err;
tail = TIPC_SKB_CB(head)->tail;
if (skb_try_coalesce(head, frag, &headstolen, &delta)) { if (skb_try_coalesce(head, frag, &headstolen, &delta)) {
kfree_skb_partial(frag, headstolen); kfree_skb_partial(frag, headstolen);
} else { } else {
tail = TIPC_SKB_CB(head)->tail;
if (!skb_has_frag_list(head)) if (!skb_has_frag_list(head))
skb_shinfo(head)->frag_list = frag; skb_shinfo(head)->frag_list = frag;
else else
@@ -102,6 +113,7 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
head->len += frag->len; head->len += frag->len;
TIPC_SKB_CB(head)->tail = frag; TIPC_SKB_CB(head)->tail = frag;
} }
if (fragid == LAST_FRAGMENT) { if (fragid == LAST_FRAGMENT) {
*buf = head; *buf = head;
TIPC_SKB_CB(head)->tail = NULL; TIPC_SKB_CB(head)->tail = NULL;
@@ -110,7 +122,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
} }
*buf = NULL; *buf = NULL;
return 0; return 0;
out_free:
err:
pr_warn_ratelimited("Unable to build fragment list\n"); pr_warn_ratelimited("Unable to build fragment list\n");
kfree_skb(*buf); kfree_skb(*buf);
kfree_skb(*headbuf); kfree_skb(*headbuf);