diff options
| author |   David S. Miller <davem@davemloft.net> | 2015-12-14 16:16:46 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-12-14 16:16:46 -0500 |
| commit | e286213484e724dcba21c214f7316fdf6ccbcf6b (patch) | |
| tree | 5ef8f7c06ac72666920940bd137ced0761d6b1b9 /net/iucv/af_iucv.c | |
| parent | ipv6: addrconf: drop ieee802154 specific things (diff) | |
| parent | qeth: get rid of redundant 0-termination (diff) | |
| download | linux-dev-e286213484e724dcba21c214f7316fdf6ccbcf6b.tar.xz linux-dev-e286213484e724dcba21c214f7316fdf6ccbcf6b.zip | |
Merge branch 's390-next'
Ursula Braun says:
====================
s390 network patches
here are some s390 related patches for net-next. Most important is
the skb_linearize af_iucv patch from Eugene solving traffic problems
in certain scenarios. The remaining patches are minor improvements.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/iucv/af_iucv.c')
| -rw-r--r-- | net/iucv/af_iucv.c | 22 |
1 files changed, 16 insertions, 6 deletions
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c index 3ea4c98d94dc..ef50a94d3eb7 100644 --- a/net/iucv/af_iucv.c +++ b/net/iucv/af_iucv.c @@ -1031,7 +1031,7 @@ static int iucv_sock_sendmsg(struct socket *sock, struct msghdr *msg, struct sock *sk = sock->sk; struct iucv_sock *iucv = iucv_sk(sk); struct sk_buff *skb; - struct iucv_message txmsg; + struct iucv_message txmsg = {0}; struct cmsghdr *cmsg; int cmsg_done; long timeo; @@ -2084,11 +2084,7 @@ static int afiucv_hs_callback_rx(struct sock *sk, struct sk_buff *skb) return NET_RX_SUCCESS; } - /* write stuff from iucv_msg to skb cb */ - if (skb->len < sizeof(struct af_iucv_trans_hdr)) { - kfree_skb(skb); - return NET_RX_SUCCESS; - } + /* write stuff from iucv_msg to skb cb */ skb_pull(skb, sizeof(struct af_iucv_trans_hdr)); skb_reset_transport_header(skb); skb_reset_network_header(skb); @@ -2119,6 +2115,20 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev, char nullstring[8]; int err = 0; + if (skb->len < (ETH_HLEN + sizeof(struct af_iucv_trans_hdr))) { + WARN_ONCE(1, "AF_IUCV too short skb, len=%d, min=%d", + (int)skb->len, + (int)(ETH_HLEN + sizeof(struct af_iucv_trans_hdr))); + kfree_skb(skb); + return NET_RX_SUCCESS; + } + if (skb_headlen(skb) < (ETH_HLEN + sizeof(struct af_iucv_trans_hdr))) + if (skb_linearize(skb)) { + WARN_ONCE(1, "AF_IUCV skb_linearize failed, len=%d", + (int)skb->len); + kfree_skb(skb); + return NET_RX_SUCCESS; + } skb_pull(skb, ETH_HLEN); trans_hdr = (struct af_iucv_trans_hdr *)skb->data; EBCASC(trans_hdr->destAppName, sizeof(trans_hdr->destAppName)); |