Jon Paul Maloy 681a55d717 tipc: move premature initilalization of stack variables ...

In the function tipc_rcv() we initialize a couple of stack variables
from the message header before that same header has been validated.
In rare cases when the arriving header is non-linar, the validation
function itself may linearize the buffer by calling skb_may_pull(),
while the wrongly initialized stack fields are not updated accordingly.

We fix this in this commit.

Reported-by: Matthew Wong <mwong@sonusnet.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-02-24 11:42:54 -05:00

..

addr.c

…

addr.h

…

bcast.c

…

bcast.h

…

bearer.c

…

bearer.h

…

core.c

…

core.h

…

discover.c

…

discover.h

…

eth_media.c

…

ib_media.c

…

Kconfig

…

link.c

…

link.h

…

Makefile

…

monitor.c

…

monitor.h

…

msg.c

…

msg.h

…

name_distr.c

…

name_distr.h

…

name_table.c

…

name_table.h

…

net.c

tipc: Fix tipc_sk_reinit race conditions

2017-02-17 12:28:35 -05:00

net.h

…

netlink_compat.c

…

netlink.c

…

netlink.h

…

node.c

tipc: move premature initilalization of stack variables

2017-02-24 11:42:54 -05:00

node.h

…

server.c

tipc: fix cleanup at module unload

2017-01-24 16:14:58 -05:00

server.h

…

socket.c

tipc: Fix tipc_sk_reinit race conditions

2017-02-17 12:28:35 -05:00

socket.h

…

subscr.c

…

subscr.h

…

sysctl.c

…

udp_media.c

…

udp_media.h

…