summaryrefslogtreecommitdiff
path: root/net/tipc
diff options
context:
space:
mode:
authorAllan Stephens <allan.stephens@windriver.com>2011-04-07 22:57:53 +0400
committerPaul Gortmaker <paul.gortmaker@windriver.com>2011-09-01 19:16:37 +0400
commit9f6bdcd4286145e812058e4111e906e9830514d8 (patch)
tree081570fcafbd5329c788b9ef46c5e1b8b306ba2a /net/tipc
parent693d03ae3c2bafd7caca1cf4ade9f23f107e33c1 (diff)
downloadlinux-9f6bdcd4286145e812058e4111e906e9830514d8.tar.xz
tipc: Discard incoming broadcast messages that are unexpected
Modifies TIPC's incoming broadcast packet handler to discard messages that cannot legally be sent over the broadcast link, including: - broadcast protocol messages that do no contain state information - payload messages that are not named multicast messages - any other form of message except for bundled messages, fragmented messages, and name distribution messages. These checks are needed to prevent TIPC from handing an unexpected message to a routine that isn't prepared to handle it, which could lead to incorrect processing (up to and including invalid memory references caused by attempts to access message fields that aren't present in the message). Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Diffstat (limited to 'net/tipc')
-rw-r--r--net/tipc/bcast.c13
1 files changed, 11 insertions, 2 deletions
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 8d298526a5c1..bead28b5efff 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -39,6 +39,7 @@
#include "link.h"
#include "port.h"
#include "bcast.h"
+#include "name_distr.h"
#define MAX_PKT_DEFAULT_MCAST 1500 /* bcast link max packet size (fixed) */
@@ -445,6 +446,8 @@ void tipc_bclink_recv_pkt(struct sk_buff *buf)
goto unlock;
if (unlikely(msg_user(msg) == BCAST_PROTOCOL)) {
+ if (msg_type(msg) != STATE_MSG)
+ goto unlock;
if (msg_destnode(msg) == tipc_own_addr) {
tipc_bclink_acknowledge(node, msg_bcast_ack(msg));
tipc_node_unlock(node);
@@ -480,7 +483,10 @@ receive:
}
if (likely(msg_isdata(msg))) {
tipc_node_unlock(node);
- tipc_port_recv_mcast(buf, NULL);
+ if (likely(msg_mcast(msg)))
+ tipc_port_recv_mcast(buf, NULL);
+ else
+ buf_discard(buf);
} else if (msg_user(msg) == MSG_BUNDLER) {
bcl->stats.recv_bundles++;
bcl->stats.recv_bundled += msg_msgcnt(msg);
@@ -493,9 +499,12 @@ receive:
bcl->stats.recv_fragmented++;
tipc_node_unlock(node);
tipc_net_route_msg(buf);
+ } else if (msg_user(msg) == NAME_DISTRIBUTOR) {
+ tipc_node_unlock(node);
+ tipc_named_recv(buf);
} else {
tipc_node_unlock(node);
- tipc_net_route_msg(buf);
+ buf_discard(buf);
}
buf = NULL;
tipc_node_lock(node);