linux-stable.git/net/tipc/node.c, branch linux-3.16.y

tipc: fix an infoleak in tipc_nl_compat_link_dump

2016-08-22T21:38:28+00:00

commit 5d2be1422e02ccd697ccfcd45c85b4a26e6178e2 upstream.

link_info.str is a char array of size 60. Memory after the NULL
byte is not initialized. Sending the whole object out can cause
a leak.

Signed-off-by: Kangjie Lu 
Signed-off-by: David S. Miller 
[carnil: Backported to 3.16 (same as bwh did for 3.2): the unpadded strcpy() is
in tipc_node_get_links() and no nlattr is involved, so use strncpy()]
Signed-off-by: Ben Hutchings

tipc: rename and move message reassembly function

2014-05-14T19:19:48+00:00

The function tipc_link_frag_rcv() is in reality a re-entrant generic
message reassemby function that has nothing in particular to do with
the link, where it is defined now. This becomes obvious when we see
the need to call the function from other places in the code.

In this commit rename it to tipc_buf_append() and move it to the file
msg.c. We also simplify its signature by moving the tail pointer to
the control block of the head buffer, hence making the head buffer
self-contained.

Signed-off-by: Jon Maloy 
Reviewed-by: Ying Xue 
Signed-off-by: David S. Miller

tipc: don't directly overwrite node action_flags

2014-05-09T05:41:01+00:00

Each node action flag should be set or cleared separately, instead
we now set the whole flags variable in one shot, and it's turned
out to be hard to see which other flags are affected. Therefore,
for instance, we explicitly clear TIPC_WAIT_OWN_LINKS_DOWN bit in
node_lost_contact().

Signed-off-by: Ying Xue 
Reviewed-by: Jon Maloy 
Signed-off-by: David S. Miller

tipc: rename enum names of node flags

2014-05-09T05:41:01+00:00

Rename node flags to action_flags as well as its enum names so
that they can reflect its real meanings.

Signed-off-by: Ying Xue 
Reviewed-by: Jon Maloy 
Signed-off-by: David S. Miller

tipc: avoid to asynchronously deliver name tables to peer node

2014-05-05T21:26:44+00:00

Postpone the actions of delivering name tables until after node
lock is released, avoiding to do it under asynchronous context.

Signed-off-by: Ying Xue 
Reviewed-by: Erik Hugne 
Reviewed-by: Jon Maloy 
Signed-off-by: David S. Miller

tipc: remove TIPC_NAMES_GONE node flag

2014-05-05T21:26:44+00:00

Since previously what all publications pertaining to the lost node
were removed from name table was finished in tasklet context
asynchronously, we need to TIPC_NAMES_GONE flag indicating whether
the node cleanup work is finished or not. But now as the cleanup work
has been finished when node lock is released, the flag becomes
meaningless for us.

Signed-off-by: Ying Xue 
Reviewed-by: Erik Hugne 
Reviewed-by: Jon Maloy 
Signed-off-by: David S. Miller

tipc: avoid to asynchronously notify subscriptions

2014-05-05T21:26:44+00:00

Postpone the actions of notifying subscriptions until after node lock
is released, avoiding to asynchronously execute registered handlers
when node is lost.

Signed-off-by: Ying Xue 
Reviewed-by: Erik Hugne 
Reviewed-by: Jon Maloy 
Signed-off-by: David S. Miller

tipc: rename setup_blocked variable of node struct to flags

2014-05-05T21:26:44+00:00

Rename setup_blocked variable of node struct to a more common
name called "flags", which will be used to represent kinds of
node states.

Signed-off-by: Ying Xue 
Reviewed-by: Erik Hugne 
Reviewed-by: Jon Maloy 
Signed-off-by: David S. Miller

tipc: fix out of bounds indexing

2014-04-28T18:43:35+00:00

Commit 78acb1f9b898e85fa2c1e28e700b54b66b288e8d ("tipc: add
ioctl to fetch link names") introduced a buffer overflow bug where
specially crafted ioctl requests could cause out-of-bounds indexing
of the node->links array. This was caused by an incorrect check vs
MAX_BEARERS, and the static code checker complaint is:
net/tipc/node.c:459 tipc_node_get_linkname() error: buffer overflow 'node->links' 2 <= 2

Signed-off-by: Erik Hugne 
Reported-by: Dan Carpenter 
Signed-off-by: David S. Miller

tipc: add ioctl to fetch link names

2014-04-26T16:13:24+00:00

We add a new ioctl for AF_TIPC that can be used to fetch the
logical name for a link to a remote node on a given bearer. This
should be used in combination with link state subscriptions.
The logical name size limit definitions are moved to tipc.h, as
they are now also needed by the new ioctl.

Signed-off-by: Erik Hugne 
Reviewed-by: Ying Xue 
Reviewed-by: Jon Maloy 
Signed-off-by: David S. Miller