mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
tipc: Fix bugs in rejection of message with short header
This patch ensures that TIPC doesn't try to access non-existent message header fields when rejecting a message with a short header. Signed-off-by: Allan Stephens <allan.stephens@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
9bef54383d
commit
99c145939b
1 changed files with 6 additions and 4 deletions
|
@ -448,13 +448,15 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err)
|
|||
msg_set_errcode(rmsg, err);
|
||||
msg_set_destport(rmsg, msg_origport(msg));
|
||||
msg_set_origport(rmsg, msg_destport(msg));
|
||||
if (msg_short(msg))
|
||||
if (msg_short(msg)) {
|
||||
msg_set_orignode(rmsg, tipc_own_addr);
|
||||
else
|
||||
/* leave name type & instance as zeroes */
|
||||
} else {
|
||||
msg_set_orignode(rmsg, msg_destnode(msg));
|
||||
msg_set_nametype(rmsg, msg_nametype(msg));
|
||||
msg_set_nameinst(rmsg, msg_nameinst(msg));
|
||||
}
|
||||
msg_set_size(rmsg, data_sz + hdr_sz);
|
||||
msg_set_nametype(rmsg, msg_nametype(msg));
|
||||
msg_set_nameinst(rmsg, msg_nameinst(msg));
|
||||
skb_copy_to_linear_data_offset(rbuf, hdr_sz, msg_data(msg), data_sz);
|
||||
|
||||
/* send self-abort message when rejecting on a connected port */
|
||||
|
|
Loading…
Reference in a new issue