* [PATCH] tipc: reinitialize pointer after skb linearize
@ 2015-09-18 8:46 erik.hugne
2015-09-18 9:44 ` Ying Xue
2015-09-21 5:31 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: erik.hugne @ 2015-09-18 8:46 UTC (permalink / raw)
To: netdev; +Cc: tipc-discussion
From: Erik Hugne <erik.hugne@ericsson.com>
The msg pointer into header may change after skb linearization.
We must reinitialize it after calling skb_linearize to prevent
operating on a freed or invalid pointer.
Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reported-by: Tamás Végh <tamas.vegh@ericsson.com>
---
net/tipc/msg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 562c926..c5ac436 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -539,6 +539,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
*err = -TIPC_ERR_NO_NAME;
if (skb_linearize(skb))
return false;
+ msg = buf_msg(skb);
if (msg_reroute_cnt(msg))
return false;
dnode = addr_domain(net, msg_lookup_scope(msg));
--
2.1.4
------------------------------------------------------------------------------
_______________________________________________
tipc-discussion mailing list
tipc-discussion@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tipc-discussion
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] tipc: reinitialize pointer after skb linearize
2015-09-18 8:46 [PATCH] tipc: reinitialize pointer after skb linearize erik.hugne
@ 2015-09-18 9:44 ` Ying Xue
2015-09-21 5:31 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Ying Xue @ 2015-09-18 9:44 UTC (permalink / raw)
To: erik.hugne, netdev; +Cc: tipc-discussion
On 09/18/2015 04:46 PM, erik.hugne@ericsson.com wrote:
> From: Erik Hugne <erik.hugne@ericsson.com>
>
> The msg pointer into header may change after skb linearization.
> We must reinitialize it after calling skb_linearize to prevent
> operating on a freed or invalid pointer.
>
> Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
> Reported-by: Tamás Végh <tamas.vegh@ericsson.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
> ---
> net/tipc/msg.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/net/tipc/msg.c b/net/tipc/msg.c
> index 562c926..c5ac436 100644
> --- a/net/tipc/msg.c
> +++ b/net/tipc/msg.c
> @@ -539,6 +539,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
> *err = -TIPC_ERR_NO_NAME;
> if (skb_linearize(skb))
> return false;
> + msg = buf_msg(skb);
> if (msg_reroute_cnt(msg))
> return false;
> dnode = addr_domain(net, msg_lookup_scope(msg));
>
------------------------------------------------------------------------------
_______________________________________________
tipc-discussion mailing list
tipc-discussion@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tipc-discussion
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] tipc: reinitialize pointer after skb linearize
2015-09-18 8:46 [PATCH] tipc: reinitialize pointer after skb linearize erik.hugne
2015-09-18 9:44 ` Ying Xue
@ 2015-09-21 5:31 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2015-09-21 5:31 UTC (permalink / raw)
To: erik.hugne; +Cc: netdev, tipc-discussion
From: <erik.hugne@ericsson.com>
Date: Fri, 18 Sep 2015 10:46:31 +0200
> From: Erik Hugne <erik.hugne@ericsson.com>
>
> The msg pointer into header may change after skb linearization.
> We must reinitialize it after calling skb_linearize to prevent
> operating on a freed or invalid pointer.
>
> Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
> Reported-by: Tamás Végh <tamas.vegh@ericsson.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-09-21 5:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-09-18 8:46 [PATCH] tipc: reinitialize pointer after skb linearize erik.hugne
2015-09-18 9:44 ` Ying Xue
2015-09-21 5:31 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).