diff options
| author | Jon Paul Maloy <jon.maloy@ericsson.com> | 2014-06-09 11:08:18 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-06-11 15:01:30 -0700 |
| commit | 02c00c2ab0807ec64b480e899d2619e64566a0af (patch) | |
| tree | 5d095614085cc212ed347df4e996fc376f308a90 /net/tipc | |
| parent | cf97b8ff22a0d8b81dead6baff551642c9ead8e7 (diff) | |
tipc: fix potential bug in function tipc_backlog_rcv
In commit 4f4482dcd9a0606a30541ff165ddaca64748299b ("tipc: compensate
for double accounting in socket rcv buffer") we access 'truesize' of
a received buffer after it might have been released by the function
filter_rcv().
In this commit we correct this by reading the value of 'truesize' to
the stack before delivering the buffer to filter_rcv().
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
| -rw-r--r-- | net/tipc/socket.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 08d87fc80b10..ef0475568f9e 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1,5 +1,5 @@ /* -* net/tipc/socket.c: TIPC socket API + * net/tipc/socket.c: TIPC socket API * * Copyright (c) 2001-2007, 2012-2014, Ericsson AB * Copyright (c) 2004-2008, 2010-2013, Wind River Systems @@ -1431,13 +1431,14 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *buf) { u32 res; struct tipc_sock *tsk = tipc_sk(sk); + uint truesize = buf->truesize; res = filter_rcv(sk, buf); if (unlikely(res)) tipc_reject_msg(buf, res); if (atomic_read(&tsk->dupl_rcvcnt) < TIPC_CONN_OVERLOAD_LIMIT) - atomic_add(buf->truesize, &tsk->dupl_rcvcnt); + atomic_add(truesize, &tsk->dupl_rcvcnt); return 0; } |