From: Parthasarathy Bhuvaragan Date: Tue, 2 Feb 2016 09:52:13 +0000 (+0100) Subject: tipc: fix connection abort when receiving invalid cancel request X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=cb01c7c8701a35866479753fe78d04bd9826dd1b;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git tipc: fix connection abort when receiving invalid cancel request Until now, the subscribers endianness for a subscription create/cancel request is determined as: swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE)) The checks are performed only for port/service subscriptions. The swap calculation is incorrect if the filter in the subscription cancellation request is set to TIPC_SUB_CANCEL (it's a malformed cancel request, as the corresponding subscription create filter is missing). Thus, the check if the request is for cancellation fails and the request is treated as a subscription create request. The subscription creation fails as the request is illegal, which terminates this connection. In this commit we determine the endianness by including TIPC_SUB_CANCEL, which will set swap correctly and the request is processed as a cancellation request. Acked-by: Ying Xue Reviewed-by: Jon Maloy Signed-off-by: Parthasarathy Bhuvaragan Signed-off-by: David S. Miller --- diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c index 531227208ae2..24d2c8128bac 100644 --- a/net/tipc/subscr.c +++ b/net/tipc/subscr.c @@ -309,7 +309,8 @@ static void tipc_subscrb_rcv_cb(struct net *net, int conid, int swap; /* Determine subscriber's endianness */ - swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE)); + swap = !(s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE | + TIPC_SUB_CANCEL)); /* Detect & process a subscription cancellation request */ if (s->filter & htohl(TIPC_SUB_CANCEL, swap)) {