When extracting an individual message from a received "bundle" buffer, we just create a clone of the base buffer, and adjust it to point into the right position of the linearized data area of the latter. This works well for regular message reception, but during periods of extremely high load it may happen that an extracted buffer, e.g, a connection probe, is reversed and forwarded through an external interface while the preceding extracted message is still unhandled. When this happens, the header or data area of the preceding message will be partially overwritten by a MAC header, leading to unpredicatable consequences, such as a link reset.
We now fix this by ensuring that the msg_reverse() function never returns a cloned buffer, and that the returned buffer always contains sufficient valid head and tail room to be forwarded. Reported-by: Erik Hugne <[email protected]> Signed-off-by: Jon Maloy <[email protected]> --- net/tipc/msg.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 8740930..00b4f26 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -492,7 +492,7 @@ bool tipc_msg_reverse(u32 own_node, struct sk_buff **skb, int err) /* Take a copy of original header before altering message */ memcpy(&ohdr, hdr, msg_hdr_sz(hdr)); - /* Never return SHORT header; expand by replacing buffer if necessary */ + /* Never return SHORT header or cloned buffer */ if (msg_short(hdr)) { *skb = tipc_buf_acquire(BASIC_H_SIZE + dlen); if (!*skb) @@ -503,6 +503,14 @@ bool tipc_msg_reverse(u32 own_node, struct sk_buff **skb, int err) hdr = buf_msg(_skb); memcpy(hdr, &ohdr, BASIC_H_SIZE); msg_set_hdr_sz(hdr, BASIC_H_SIZE); + } else if (skb_cloned(_skb)) { + *skb = tipc_buf_acquire(msg_hdr_sz(hdr) + dlen); + if (!*skb) + goto exit; + memcpy((*skb)->data, _skb->data, msg_size(&ohdr)); + kfree_skb(_skb); + _skb = *skb; + hdr = buf_msg(_skb); } /* Now reverse the concerned fields */ -- 1.9.1 ------------------------------------------------------------------------------ What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports. http://pubads.g.doubleclick.net/gampad/clk?id=1444514421&iu=/41014381 _______________________________________________ tipc-discussion mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tipc-discussion
