From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 15 Dec 2015 00:01:42 +0000 (-0800)
Subject: fix up tipc patch body for 4.3
X-Git-Tag: v4.1.15~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f4eb46865c067fb64ada50f2ca2f49af11cac3b3;p=thirdparty%2Fkernel%2Fstable-queue.git

fix up tipc patch body for 4.3
---

diff --git a/queue-4.3/tipc-fix-error-handling-of-expanding-buffer-headroom.patch b/queue-4.3/tipc-fix-error-handling-of-expanding-buffer-headroom.patch
index 57f7c17e4df..c749d75d695 100644
--- a/queue-4.3/tipc-fix-error-handling-of-expanding-buffer-headroom.patch
+++ b/queue-4.3/tipc-fix-error-handling-of-expanding-buffer-headroom.patch
@@ -8,6 +8,36 @@ From: Ying Xue <ying.xue@windriver.com>
 [ Upstream commit 7098356baca723513e97ca0020df4e18bc353be3 ]
 
 Coverity says:
+*** CID 1338065:  Error handling issues  (CHECKED_RETURN)
+/net/tipc/udp_media.c: 162 in tipc_udp_send_msg()
+156             struct udp_media_addr *dst = (struct udp_media_addr *)&dest->value;
+157             struct udp_media_addr *src = (struct udp_media_addr *)&b->addr.value;
+158             struct sk_buff *clone;
+159             struct rtable *rt;
+160
+161             if (skb_headroom(skb) < UDP_MIN_HEADROOM)
+>>>     CID 1338065:  Error handling issues  (CHECKED_RETURN)
+>>>     Calling "pskb_expand_head" without checking return value (as is done elsewhere 51 out of 56
++times).
+162                     pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
+163
+164             clone = skb_clone(skb, GFP_ATOMIC);
+165             skb_set_inner_protocol(clone, htons(ETH_P_TIPC));
+166             ub = rcu_dereference_rtnl(b->media_ptr);
+167             if (!ub) {
+
+When expanding buffer headroom over udp tunnel with pskb_expand_head(),
+it's unfortunate that we don't check its return value. As a result, if
+the function returns an error code due to the lack of memory, it may
+cause unpredictable consequence as we unconditionally consider that
+it's always successful.
+
+Fixes: e53567948f82 ("tipc: conditionally expand buffer headroom over udp tunnel")
+Reported-by: <scan-admin@coverity.com>
+Cc: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 ---
  net/tipc/udp_media.c |    7 +++++--