6 files changed, 103 insertions, 14 deletions

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 2792a3cae682..85ad5c0678d0 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
         default:
                 pr_warn("Dropping received illegal msg type\n");
                 kfree_skb(skb);
-                return false;
+                return true;
         };
 }
 
@@ -1425,6 +1425,10 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
                 l->rcv_unacked = 0;
         } else {
                 /* RESET_MSG or ACTIVATE_MSG */
+                if (mtyp == ACTIVATE_MSG) {
+                        msg_set_dest_session_valid(hdr, 1);
+                        msg_set_dest_session(hdr, l->peer_session);
+                }
                 msg_set_max_pkt(hdr, l->advertised_mtu);
                 strcpy(data, l->if_name);
                 msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
@@ -1642,6 +1646,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
                         break;
                 }
+
+                /* If this endpoint was re-created while peer was ESTABLISHING
+                 * it doesn't know current session number. Force re-synch.
+                 */
+                if (mtyp == ACTIVATE_MSG && msg_dest_session_valid(hdr) &&
+                    l->session != msg_dest_session(hdr)) {
+                        if (less(l->session, msg_dest_session(hdr)))
+                                l->session = msg_dest_session(hdr) + 1;
+                        break;
+                }
+
                 /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
                 if (mtyp == RESET_MSG || !link_is_up(l))
                         rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index a0924956bb61..d7e4b8b93f9d 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -360,6 +360,28 @@ static inline void msg_set_bcast_ack(struct tipc_msg *m, u16 n)
         msg_set_bits(m, 1, 0, 0xffff, n);
 }
 
+/* Note: reusing bits in word 1 for ACTIVATE_MSG only, to re-synch
+ * link peer session number
+ */
+static inline bool msg_dest_session_valid(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 16, 0x1);
+}
+
+static inline void msg_set_dest_session_valid(struct tipc_msg *m, bool valid)
+{
+        msg_set_bits(m, 1, 16, 0x1, valid);
+}
+
+static inline u16 msg_dest_session(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 0, 0xffff);
+}
+
+static inline void msg_set_dest_session(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 1, 0, 0xffff, n);
+}
 
 /*
  * Word 2
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 40f5cae623a7..4ad3586da8f0 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -87,6 +87,11 @@ static int tipc_skb_tailroom(struct sk_buff *skb)
         return limit;
 }
 
+static inline int TLV_GET_DATA_LEN(struct tlv_desc *tlv)
+{
+        return TLV_GET_LEN(tlv) - TLV_SPACE(0);
+}
+
 static int tipc_add_tlv(struct sk_buff *skb, u16 type, void *data, u16 len)
 {
         struct tlv_desc *tlv = (struct tlv_desc *)skb_tail_pointer(skb);
@@ -166,6 +171,11 @@ static struct sk_buff *tipc_get_err_tlv(char *str)
         return buf;
 }
 
+static inline bool string_is_valid(char *s, int len)
+{
+        return memchr(s, '\0', len) ? true : false;
+}
+
 static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
                                    struct tipc_nl_compat_msg *msg,
                                    struct sk_buff *arg)
@@ -379,6 +389,7 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
         struct nlattr *prop;
         struct nlattr *bearer;
         struct tipc_bearer_config *b;
+        int len;
 
         b = (struct tipc_bearer_config *)TLV_DATA(msg->req);
 
@@ -386,6 +397,10 @@ static int tipc_nl_compat_bearer_enable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        if (!string_is_valid(b->name, len))
+                return -EINVAL;
+
         if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, b->name))
                 return -EMSGSIZE;
 
@@ -411,6 +426,7 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
 {
         char *name;
         struct nlattr *bearer;
+        int len;
 
         name = (char *)TLV_DATA(msg->req);
 
@@ -418,6 +434,10 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        if (!string_is_valid(name, len))
+                return -EINVAL;
+
         if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, name))
                 return -EMSGSIZE;
 
@@ -478,6 +498,7 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
         struct nlattr *prop[TIPC_NLA_PROP_MAX + 1];
         struct nlattr *stats[TIPC_NLA_STATS_MAX + 1];
         int err;
+        int len;
 
         if (!attrs[TIPC_NLA_LINK])
                 return -EINVAL;
@@ -504,6 +525,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
                 return err;
 
         name = (char *)TLV_DATA(msg->req);
+
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        if (!string_is_valid(name, len))
+                return -EINVAL;
+
         if (strcmp(name, nla_data(link[TIPC_NLA_LINK_NAME])) != 0)
                 return 0;
 
@@ -644,6 +670,7 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
         struct nlattr *prop;
         struct nlattr *media;
         struct tipc_link_config *lc;
+        int len;
 
         lc = (struct tipc_link_config *)TLV_DATA(msg->req);
 
@@ -651,6 +678,10 @@ static int tipc_nl_compat_media_set(struct sk_buff *skb,
         if (!media)
                 return -EMSGSIZE;
 
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
+        if (!string_is_valid(lc->name, len))
+                return -EINVAL;
+
         if (nla_put_string(skb, TIPC_NLA_MEDIA_NAME, lc->name))
                 return -EMSGSIZE;
 
@@ -671,6 +702,7 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
         struct nlattr *prop;
         struct nlattr *bearer;
         struct tipc_link_config *lc;
+        int len;
 
         lc = (struct tipc_link_config *)TLV_DATA(msg->req);
 
@@ -678,6 +710,10 @@ static int tipc_nl_compat_bearer_set(struct sk_buff *skb,
         if (!bearer)
                 return -EMSGSIZE;
 
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_MEDIA_NAME);
+        if (!string_is_valid(lc->name, len))
+                return -EINVAL;
+
         if (nla_put_string(skb, TIPC_NLA_BEARER_NAME, lc->name))
                 return -EMSGSIZE;
 
@@ -726,9 +762,14 @@ static int tipc_nl_compat_link_set(struct tipc_nl_compat_cmd_doit *cmd,
         struct tipc_link_config *lc;
         struct tipc_bearer *bearer;
         struct tipc_media *media;
+        int len;
 
         lc = (struct tipc_link_config *)TLV_DATA(msg->req);
 
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        if (!string_is_valid(lc->name, len))
+                return -EINVAL;
+
         media = tipc_media_find(lc->name);
         if (media) {
                 cmd->doit = &__tipc_nl_media_set;
@@ -750,6 +791,7 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
 {
         char *name;
         struct nlattr *link;
+        int len;
 
         name = (char *)TLV_DATA(msg->req);
 
@@ -757,6 +799,10 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
         if (!link)
                 return -EMSGSIZE;
 
+        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        if (!string_is_valid(name, len))
+                return -EINVAL;
+
         if (nla_put_string(skb, TIPC_NLA_LINK_NAME, name))
                 return -EMSGSIZE;
 
@@ -778,6 +824,8 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg)
         };
 
         ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req);
+        if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query))
+                return -EINVAL;
 
         depth = ntohl(ntq->depth);
 
@@ -904,8 +952,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
 
         hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
                           TIPC_NL_PUBL_GET);
-        if (!hdr)
+        if (!hdr) {
+                kfree_skb(args);
                 return -EMSGSIZE;
+        }
 
         nest = nla_nest_start(args, TIPC_NLA_SOCK);
         if (!nest) {
@@ -1206,7 +1256,7 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
         }
 
         len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
-        if (len && !TLV_OK(msg.req, len)) {
+        if (!len || !TLV_OK(msg.req, len)) {
                 msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
                 err = -EOPNOTSUPP;
                 goto send;
diff --git a/net/tipc/node.c b/net/tipc/node.c
index db2a6c3e0be9..2dc4919ab23c 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -830,15 +830,16 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
         tipc_node_write_lock(n);
         if (!tipc_link_is_establishing(l)) {
                 __tipc_node_link_down(n, &bearer_id, &xmitq, &maddr);
-                if (delete) {
-                        kfree(l);
-                        le->link = NULL;
-                        n->link_cnt--;
-                }
         } else {
                 /* Defuse pending tipc_node_link_up() */
+                tipc_link_reset(l);
                 tipc_link_fsm_evt(l, LINK_RESET_EVT);
         }
+        if (delete) {
+                kfree(l);
+                le->link = NULL;
+                n->link_cnt--;
+        }
         trace_tipc_node_link_down(n, true, "node link down or deleted!");
         tipc_node_write_unlock(n);
         if (delete)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 1217c90a363b..684f2125fc6b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -388,7 +388,7 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout)
                 rc_ = tipc_sk_sock_err((sock_), timeo_);                       \
                 if (rc_)                                                       \
                         break;                                                 \
-                prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE);    \
+                add_wait_queue(sk_sleep(sk_), &wait_);                         \
                 release_sock(sk_);                                             \
                 *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \
                 sched_annotate_sleep();                                        \
@@ -1677,7 +1677,7 @@ static void tipc_sk_send_ack(struct tipc_sock *tsk)
 static int tipc_wait_for_rcvmsg(struct socket *sock, long *timeop)
 {
         struct sock *sk = sock->sk;
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
         long timeo = *timeop;
         int err = sock_error(sk);
 
@@ -1685,15 +1685,17 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long *timeop)
                 return err;
 
         for (;;) {
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                         if (sk->sk_shutdown & RCV_SHUTDOWN) {
                                 err = -ENOTCONN;
                                 break;
                         }
+                        add_wait_queue(sk_sleep(sk), &wait);
                         release_sock(sk);
-                        timeo = schedule_timeout(timeo);
+                        timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+                        sched_annotate_sleep();
                         lock_sock(sk);
+                        remove_wait_queue(sk_sleep(sk), &wait);
                 }
                 err = 0;
                 if (!skb_queue_empty(&sk->sk_receive_queue))
@@ -1709,7 +1711,6 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long *timeop)
                 if (err)
                         break;
         }
-        finish_wait(sk_sleep(sk), &wait);
         *timeop = timeo;
         return err;
 }
diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
index efb16f69bd2c..a457c0fbbef1 100644
--- a/net/tipc/topsrv.c
+++ b/net/tipc/topsrv.c
@@ -398,7 +398,7 @@ static int tipc_conn_rcv_from_sock(struct tipc_conn *con)
         ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT);
         if (ret == -EWOULDBLOCK)
                 return -EWOULDBLOCK;
-        if (ret > 0) {
+        if (ret == sizeof(s)) {
                 read_lock_bh(&sk->sk_callback_lock);
                 ret = tipc_conn_rcv_sub(srv, con, &s);
                 read_unlock_bh(&sk->sk_callback_lock);