diff mbox

tipc: don't reject messages if reversal fails

Message ID 1428666313-9117-1-git-send-email-erik.hugne@ericsson.com
State Rejected, archived
Delegated to: David Miller
Headers show

Commit Message

Erik Hugne April 10, 2015, 11:45 a.m. UTC 
From: Erik Hugne <erik.hugne@ericsson.com>

When we fail to deliver a message to a socket, it is subject to
message reversal. If the call to tipc_msg_reverse fails, we are
passing dnode uninitialized to tipc_link_xmit_skb which causes the
packet to either be dropped, or sent out to a random link. In the
worst case this leads to a link reset.
We fix this by only transmitting the message if reversal succeded.

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
---
 net/tipc/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index ee90d74..34bc96c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1701,7 +1701,7 @@  static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 			atomic_add(truesize, dcnt);
 		return 0;
 	}
-	if (!err || tipc_msg_reverse(tsk_own_node(tsk), skb, &dnode, -err))
+	if (!err && tipc_msg_reverse(tsk_own_node(tsk), skb, &dnode, -err))
 		tipc_link_xmit_skb(net, skb, dnode, tsk->portid);
 	return 0;
 }