diff options
| author | Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> | 2016-02-02 10:52:13 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-02-06 03:41:58 -0500 |
| commit | cb01c7c8701a35866479753fe78d04bd9826dd1b (patch) | |
| tree | 6ec13eff7ab2c7b33e328094dbb0f49b064769ab /net/tipc | |
| parent | c8beccc67c833db4a01c621cbc6eb0a577286806 (diff) | |
tipc: fix connection abort when receiving invalid cancel request
Until now, the subscribers endianness for a subscription
create/cancel request is determined as:
swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE))
The checks are performed only for port/service subscriptions.
The swap calculation is incorrect if the filter in the subscription
cancellation request is set to TIPC_SUB_CANCEL (it's a malformed
cancel request, as the corresponding subscription create filter
is missing).
Thus, the check if the request is for cancellation fails and the
request is treated as a subscription create request. The
subscription creation fails as the request is illegal, which
terminates this connection.
In this commit we determine the endianness by including
TIPC_SUB_CANCEL, which will set swap correctly and the
request is processed as a cancellation request.
Acked-by: Ying Xue <ying.xue@windriver.com>
Reviewed-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
| -rw-r--r-- | net/tipc/subscr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c index 531227208ae2..24d2c8128bac 100644 --- a/net/tipc/subscr.c +++ b/net/tipc/subscr.c @@ -309,7 +309,8 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid, int swap; /* Determine subscriber's endianness */ - swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE)); + swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE | + TIPC_SUB_CANCEL)); /* Detect & process a subscription cancellation request */ if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) { |