Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tipc: don't assume linear buffer when reading ancillary data

The code for reading ancillary data from a received buffer is assuming
the buffer is linear. To make this assumption true we have to linearize
the buffer before message data is read.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Jon Maloy and committed by
David S. Miller
1c1274a5 adba75be

+11 -4
+11 -4
net/tipc/socket.c
··· 1555 1555 /** 1556 1556 * tipc_sk_anc_data_recv - optionally capture ancillary data for received message 1557 1557 * @m: descriptor for message info 1558 - * @msg: received message header 1558 + * @skb: received message buffer 1559 1559 * @tsk: TIPC port associated with message 1560 1560 * 1561 1561 * Note: Ancillary data is not captured if not requested by receiver. 1562 1562 * 1563 1563 * Returns 0 if successful, otherwise errno 1564 1564 */ 1565 - static int tipc_sk_anc_data_recv(struct msghdr *m, struct tipc_msg *msg, 1565 + static int tipc_sk_anc_data_recv(struct msghdr *m, struct sk_buff *skb, 1566 1566 struct tipc_sock *tsk) 1567 1567 { 1568 + struct tipc_msg *msg; 1568 1569 u32 anc_data[3]; 1569 1570 u32 err; 1570 1571 u32 dest_type; ··· 1574 1573 1575 1574 if (likely(m->msg_controllen == 0)) 1576 1575 return 0; 1576 + msg = buf_msg(skb); 1577 1577 1578 1578 /* Optionally capture errored message object(s) */ 1579 1579 err = msg ? msg_errcode(msg) : 0; ··· 1585 1583 if (res) 1586 1584 return res; 1587 1585 if (anc_data[1]) { 1586 + if (skb_linearize(skb)) 1587 + return -ENOMEM; 1588 + msg = buf_msg(skb); 1588 1589 res = put_cmsg(m, SOL_TIPC, TIPC_RETDATA, anc_data[1], 1589 1590 msg_data(msg)); 1590 1591 if (res) ··· 1749 1744 1750 1745 /* Collect msg meta data, including error code and rejected data */ 1751 1746 tipc_sk_set_orig_addr(m, skb); 1752 - rc = tipc_sk_anc_data_recv(m, hdr, tsk); 1747 + rc = tipc_sk_anc_data_recv(m, skb, tsk); 1753 1748 if (unlikely(rc)) 1754 1749 goto exit; 1750 + hdr = buf_msg(skb); 1755 1751 1756 1752 /* Capture data if non-error msg, otherwise just set return value */ 1757 1753 if (likely(!err)) { ··· 1862 1856 /* Collect msg meta data, incl. error code and rejected data */ 1863 1857 if (!copied) { 1864 1858 tipc_sk_set_orig_addr(m, skb); 1865 - rc = tipc_sk_anc_data_recv(m, hdr, tsk); 1859 + rc = tipc_sk_anc_data_recv(m, skb, tsk); 1866 1860 if (rc) 1867 1861 break; 1862 + hdr = buf_msg(skb); 1868 1863 } 1869 1864 1870 1865 /* Copy data if msg ok, otherwise return error/partial data */