• Y
    tipc: fix error handling of expanding buffer headroom · 7098356b
    Ying Xue 提交于
    Coverity says:
    
    *** CID 1338065:  Error handling issues  (CHECKED_RETURN)
    /net/tipc/udp_media.c: 162 in tipc_udp_send_msg()
    156     	struct udp_media_addr *dst = (struct udp_media_addr *)&dest->value;
    157     	struct udp_media_addr *src = (struct udp_media_addr *)&b->addr.value;
    158     	struct sk_buff *clone;
    159     	struct rtable *rt;
    160
    161     	if (skb_headroom(skb) < UDP_MIN_HEADROOM)
    >>>     CID 1338065:  Error handling issues  (CHECKED_RETURN)
    >>>     Calling "pskb_expand_head" without checking return value (as is done elsewhere 51 out of 56 times).
    162     		pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
    163
    164     	clone = skb_clone(skb, GFP_ATOMIC);
    165     	skb_set_inner_protocol(clone, htons(ETH_P_TIPC));
    166     	ub = rcu_dereference_rtnl(b->media_ptr);
    167     	if (!ub) {
    
    When expanding buffer headroom over udp tunnel with pskb_expand_head(),
    it's unfortunate that we don't check its return value. As a result, if
    the function returns an error code due to the lack of memory, it may
    cause unpredictable consequence as we unconditionally consider that
    it's always successful.
    
    Fixes: e5356794 ("tipc: conditionally expand buffer headroom over udp tunnel")
    Reported-by: <scan-admin@coverity.com>
    Cc: Stephen Hemminger <stephen@networkplumber.org>
    Signed-off-by: NYing Xue <ying.xue@windriver.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    7098356b
udp_media.c 12.8 KB