diff options
author | Philippe Schenker <philippe.schenker@toradex.com> | 2022-05-19 16:29:13 +0200 |
---|---|---|
committer | Philippe Schenker <philippe.schenker@toradex.com> | 2022-05-19 16:29:13 +0200 |
commit | e6fb5c32f78f99682821f91b3959e222c93e4cb9 (patch) | |
tree | 3f6c281a7d83a6e3c0a153f93718f7cd9a39b6f7 /net/tipc/link.c | |
parent | 585dc27c53b6c1a32a7e11b724e91d7297388a13 (diff) | |
parent | b7007e1d615b8d4b71c28ebf790c5164fc4491d5 (diff) |
Merge remote-tracking branch 'gh-fslc/5.4-2.3.x-imx' into toradex_5.4-2.3.x-imx
Diffstat (limited to 'net/tipc/link.c')
-rw-r--r-- | net/tipc/link.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/net/tipc/link.c b/net/tipc/link.c index f25010261a9e..8f2ee71c63c6 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, u16 peers_tol = msg_link_tolerance(hdr); u16 peers_prio = msg_linkprio(hdr); u16 rcv_nxt = l->rcv_nxt; - u16 dlen = msg_data_sz(hdr); + u32 dlen = msg_data_sz(hdr), glen = 0; int mtyp = msg_type(hdr); bool reply = msg_probe(hdr); - u16 glen = 0; void *data; char *if_name; int rc = 0; trace_tipc_proto_rcv(skb, false, l->name); + + if (dlen > U16_MAX) + goto exit; + if (tipc_link_is_blocked(l) || !xmitq) goto exit; @@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt)) ga = NULL; } - + if(glen > dlen) + break; tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr, &l->mon_state, l->bearer_id); |