summaryrefslogtreecommitdiff
path: root/net/tipc
diff options
context:
space:
mode:
authorJon Paul Maloy <jon.maloy@ericsson.com>2014-06-09 20:08:18 +0400
committerDavid S. Miller <davem@davemloft.net>2014-06-12 02:01:30 +0400
commit02c00c2ab0807ec64b480e899d2619e64566a0af (patch)
tree5d095614085cc212ed347df4e996fc376f308a90 /net/tipc
parentcf97b8ff22a0d8b81dead6baff551642c9ead8e7 (diff)
downloadlinux-02c00c2ab0807ec64b480e899d2619e64566a0af.tar.xz
tipc: fix potential bug in function tipc_backlog_rcv
In commit 4f4482dcd9a0606a30541ff165ddaca64748299b ("tipc: compensate for double accounting in socket rcv buffer") we access 'truesize' of a received buffer after it might have been released by the function filter_rcv(). In this commit we correct this by reading the value of 'truesize' to the stack before delivering the buffer to filter_rcv(). Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
-rw-r--r--net/tipc/socket.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 08d87fc80b10..ef0475568f9e 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1,5 +1,5 @@
/*
-* net/tipc/socket.c: TIPC socket API
+ * net/tipc/socket.c: TIPC socket API
*
* Copyright (c) 2001-2007, 2012-2014, Ericsson AB
* Copyright (c) 2004-2008, 2010-2013, Wind River Systems
@@ -1431,13 +1431,14 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *buf)
{
u32 res;
struct tipc_sock *tsk = tipc_sk(sk);
+ uint truesize = buf->truesize;
res = filter_rcv(sk, buf);
if (unlikely(res))
tipc_reject_msg(buf, res);
if (atomic_read(&tsk->dupl_rcvcnt) < TIPC_CONN_OVERLOAD_LIMIT)
- atomic_add(buf->truesize, &tsk->dupl_rcvcnt);
+ atomic_add(truesize, &tsk->dupl_rcvcnt);
return 0;
}