diff options
| author | Erik Hugne <erik.hugne@ericsson.com> | 2014-08-15 16:44:35 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-10-15 12:05:27 +0200 |
| commit | 8ef544dce03e2d04a0faf56917ceb07cf5112b31 (patch) | |
| tree | 6b5f33db06ba6fc851bac8c611a3f3531cef35cf | |
| parent | 4775bfac32c89bfca5ab19e7465b4d8d53353296 (diff) | |
| download | lwn-8ef544dce03e2d04a0faf56917ceb07cf5112b31.tar.gz lwn-8ef544dce03e2d04a0faf56917ceb07cf5112b31.zip | |
tipc: fix message importance range check
[ Upstream commit ac32c7f705692b92fe12dcbe88fe87136fdfff6f ]
Commit 3b4f302d8578 ("tipc: eliminate
redundant locking") introduced a bug by removing the sanity check
for message importance, allowing programs to assign any value to
the msg_user field. This will mess up the packet reception logic
and may cause random link resets.
Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/tipc/port.h | 5 | ||||
| -rw-r--r-- | net/tipc/socket.c | 2 |
2 files changed, 5 insertions, 2 deletions
diff --git a/net/tipc/port.h b/net/tipc/port.h index cf4ca5b1d9a4..3f34cac07a2c 100644 --- a/net/tipc/port.h +++ b/net/tipc/port.h @@ -229,9 +229,12 @@ static inline int tipc_port_importance(struct tipc_port *port) return msg_importance(&port->phdr); } -static inline void tipc_port_set_importance(struct tipc_port *port, int imp) +static inline int tipc_port_set_importance(struct tipc_port *port, int imp) { + if (imp > TIPC_CRITICAL_IMPORTANCE) + return -EINVAL; msg_set_importance(&port->phdr, (u32)imp); + return 0; } #endif diff --git a/net/tipc/socket.c b/net/tipc/socket.c index ef0475568f9e..4093fd81edd5 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1841,7 +1841,7 @@ static int tipc_setsockopt(struct socket *sock, int lvl, int opt, switch (opt) { case TIPC_IMPORTANCE: - tipc_port_set_importance(port, value); + res = tipc_port_set_importance(port, value); break; case TIPC_SRC_DROPPABLE: if (sock->type != SOCK_STREAM) |