From ac32c7f705692b92fe12dcbe88fe87136fdfff6f Mon Sep 17 00:00:00 2001 From: Erik Hugne Date: Fri, 15 Aug 2014 16:44:35 +0200 Subject: tipc: fix message importance range check Commit 3b4f302d8578 ("tipc: eliminate redundant locking") introduced a bug by removing the sanity check for message importance, allowing programs to assign any value to the msg_user field. This will mess up the packet reception logic and may cause random link resets. Signed-off-by: Erik Hugne Signed-off-by: David S. Miller --- net/tipc/port.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'net/tipc/port.h') diff --git a/net/tipc/port.h b/net/tipc/port.h index 3f93454592b6..a69118ff018b 100644 --- a/net/tipc/port.h +++ b/net/tipc/port.h @@ -179,8 +179,10 @@ static inline int tipc_port_importance(struct tipc_port *port) return msg_importance(&port->phdr); } -static inline void tipc_port_set_importance(struct tipc_port *port, int imp) +static inline int tipc_port_set_importance(struct tipc_port *port, int imp) { + if (imp > TIPC_CRITICAL_IMPORTANCE) + return -EINVAL msg_set_importance(&port->phdr, (u32)imp); } -- cgit v1.2.3 From 02784f1b05b8f241c8180af88869e717e2758593 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Tue, 19 Aug 2014 11:14:02 -0700 Subject: tipc: Fix build. Missing semicolon in range check fix. Signed-off-by: David S. Miller --- net/tipc/port.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'net/tipc/port.h') diff --git a/net/tipc/port.h b/net/tipc/port.h index a69118ff018b..3087da39ee47 100644 --- a/net/tipc/port.h +++ b/net/tipc/port.h @@ -182,8 +182,9 @@ static inline int tipc_port_importance(struct tipc_port *port) static inline int tipc_port_set_importance(struct tipc_port *port, int imp) { if (imp > TIPC_CRITICAL_IMPORTANCE) - return -EINVAL + return -EINVAL; msg_set_importance(&port->phdr, (u32)imp); + return 0; } #endif -- cgit v1.2.3