Prevent message buffer corruption on receive.
An oversize incoming packet might overwrite the reference counter in a message. Prevent this by providing a buffer large enough for the largest possible packet. This will also be needed to support TLV suffixes. Signed-off-by: Richard Cochran <richardcochran@gmail.com>master
parent
c1973c5e11
commit
d7a67e9f89
5
msg.h
5
msg.h
|
@ -148,6 +148,10 @@ struct management_msg {
|
||||||
uint8_t suffix[0];
|
uint8_t suffix[0];
|
||||||
} PACKED;
|
} PACKED;
|
||||||
|
|
||||||
|
struct message_data {
|
||||||
|
uint8_t buffer[1500];
|
||||||
|
} PACKED;
|
||||||
|
|
||||||
struct ptp_message {
|
struct ptp_message {
|
||||||
union {
|
union {
|
||||||
struct ptp_header header;
|
struct ptp_header header;
|
||||||
|
@ -161,6 +165,7 @@ struct ptp_message {
|
||||||
struct pdelay_resp_fup_msg pdelay_resp_fup;
|
struct pdelay_resp_fup_msg pdelay_resp_fup;
|
||||||
struct signaling_msg signaling;
|
struct signaling_msg signaling;
|
||||||
struct management_msg management;
|
struct management_msg management;
|
||||||
|
struct message_data data;
|
||||||
} PACKED;
|
} PACKED;
|
||||||
/**/
|
/**/
|
||||||
int tail_room;
|
int tail_room;
|
||||||
|
|
2
port.c
2
port.c
|
@ -1283,7 +1283,7 @@ enum fsm_event port_event(struct port *p, int fd_index)
|
||||||
|
|
||||||
msg->hwts.type = p->timestamping;
|
msg->hwts.type = p->timestamping;
|
||||||
|
|
||||||
cnt = transport_recv(p->trp, fd, msg, sizeof(*msg), &msg->hwts);
|
cnt = transport_recv(p->trp, fd, msg, sizeof(msg->data), &msg->hwts);
|
||||||
if (cnt <= 0) {
|
if (cnt <= 0) {
|
||||||
pr_err("port %hu: recv message failed", portnum(p));
|
pr_err("port %hu: recv message failed", portnum(p));
|
||||||
msg_put(msg);
|
msg_put(msg);
|
||||||
|
|
Loading…
Reference in New Issue