* [PATCH net-next 1/1] tipc: fix potential bug in function tipc_backlog_rcv
@ 2014-06-09 16:08 Jon Maloy
2014-06-11 22:02 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jon Maloy @ 2014-06-09 16:08 UTC (permalink / raw)
To: davem
Cc: netdev, Paul Gortmaker, erik.hugne, ying.xue, maloy,
tipc-discussion, Jon Maloy
In commit 4f4482dcd9a0606a30541ff165ddaca64748299b ("tipc: compensate
for double accounting in socket rcv buffer") we access 'truesize' of
a received buffer after it might have been released by the function
filter_rcv().
In this commit we correct this by reading the value of 'truesize' to
the stack before delivering the buffer to filter_rcv().
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
---
net/tipc/socket.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 08d87fc..ef04755 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1,5 +1,5 @@
/*
-* net/tipc/socket.c: TIPC socket API
+ * net/tipc/socket.c: TIPC socket API
*
* Copyright (c) 2001-2007, 2012-2014, Ericsson AB
* Copyright (c) 2004-2008, 2010-2013, Wind River Systems
@@ -1431,13 +1431,14 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *buf)
{
u32 res;
struct tipc_sock *tsk = tipc_sk(sk);
+ uint truesize = buf->truesize;
res = filter_rcv(sk, buf);
if (unlikely(res))
tipc_reject_msg(buf, res);
if (atomic_read(&tsk->dupl_rcvcnt) < TIPC_CONN_OVERLOAD_LIMIT)
- atomic_add(buf->truesize, &tsk->dupl_rcvcnt);
+ atomic_add(truesize, &tsk->dupl_rcvcnt);
return 0;
}
--
1.7.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next 1/1] tipc: fix potential bug in function tipc_backlog_rcv
2014-06-09 16:08 [PATCH net-next 1/1] tipc: fix potential bug in function tipc_backlog_rcv Jon Maloy
@ 2014-06-11 22:02 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2014-06-11 22:02 UTC (permalink / raw)
To: jon.maloy
Cc: netdev, paul.gortmaker, erik.hugne, ying.xue, maloy, tipc-discussion
From: Jon Maloy <jon.maloy@ericsson.com>
Date: Mon, 9 Jun 2014 11:08:18 -0500
> In commit 4f4482dcd9a0606a30541ff165ddaca64748299b ("tipc: compensate
> for double accounting in socket rcv buffer") we access 'truesize' of
> a received buffer after it might have been released by the function
> filter_rcv().
>
> In this commit we correct this by reading the value of 'truesize' to
> the stack before delivering the buffer to filter_rcv().
>
> Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-06-11 22:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-06-09 16:08 [PATCH net-next 1/1] tipc: fix potential bug in function tipc_backlog_rcv Jon Maloy
2014-06-11 22:02 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.