tipc: move premature initilalization of stack variables

In the function tipc_rcv() we initialize a couple of stack variables
from the message header before that same header has been validated.
In rare cases when the arriving header is non-linar, the validation
function itself may linearize the buffer by calling skb_may_pull(),
while the wrongly initialized stack fields are not updated accordingly.

We fix this in this commit.

Reported-by: Matthew Wong <mwong@sonusnet.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/tipc/node.c b/net/tipc/node.c
index e9295fa3a554c860120f8e22a96f16c9f7e74745..4512e83652b16da259db9327fe0958c3642e70f1 100644 (file)
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1505,19 +1505,21 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
 {
        struct sk_buff_head xmitq;
        struct tipc_node *n;
-       struct tipc_msg *hdr = buf_msg(skb);
-       int usr = msg_user(hdr);
+       struct tipc_msg *hdr;
        int bearer_id = b->identity;
        struct tipc_link_entry *le;
-       u16 bc_ack = msg_bcast_ack(hdr);
        u32 self = tipc_own_addr(net);
-       int rc = 0;
+       int usr, rc = 0;
+       u16 bc_ack;
 
        __skb_queue_head_init(&xmitq);
 
-       /* Ensure message is well-formed */
+       /* Ensure message is well-formed before touching the header */
        if (unlikely(!tipc_msg_validate(skb)))
                goto discard;
+       hdr = buf_msg(skb);
+       usr = msg_user(hdr);
+       bc_ack = msg_bcast_ack(hdr);
 
        /* Handle arrival of discovery or broadcast packet */
        if (unlikely(msg_non_seq(hdr))) {