diff mbox series

[SRU,Cosmic,Bionic,Xenial,1/2] net/af_iucv: drop inbound packets with invalid flags

Message ID CA+jPhpcWH_utigsadrGNZZBK256bVGycvEHd8vK_sAemPPeZGw@mail.gmail.com
State New
Headers show
Series Fixes for LP1800639 [v2] | expand

Commit Message

Frank Heimes Nov. 2, 2018, 7:20 p.m. UTC 
From: Julian Wiedmann <jwi@linux.ibm.com>

BugLink: http://bugs.launchpad.net/bugs/1800639

net/af_iucv: drop inbound packets with invalid flags

Inbound packets may have any combination of flag bits set in their iucv
header. If we don't know how to handle a specific combination, drop the
skb instead of leaking it.

To clarify what error is returned in this case, replace the hard-coded
0 with the corresponding macro.

Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry-picked from commit 222440996d6daf635bed6cb35041be22ede3e8a0)
Signed-off-by: Frank Heimes <frank.heimes@canonical.com>

---

                WARN_ONCE(1, "AF_IUCV too short skb, len=%d, min=%d",
@@ -2254,7 +2254,7 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct
net_device *dev,
                err = afiucv_hs_callback_rx(sk, skb);
                break;
        default:
-               ;
+               kfree_skb(skb);
        }

        return err;
diff mbox series

Patch

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index a21d8ed..01000c1 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2155,8 +2155,8 @@  static int afiucv_hs_rcv(struct sk_buff *skb, struct
net_device *dev,
        struct sock *sk;
        struct iucv_sock *iucv;
        struct af_iucv_trans_hdr *trans_hdr;
+       int err = NET_RX_SUCCESS;
        char nullstring[8];
-       int err = 0;

        if (skb->len < (ETH_HLEN + sizeof(struct af_iucv_trans_hdr))) {