af_iucv: exploit target message class support of IUCV

Ursula Braun · davem330 · commit 469689a4dd47 · 2008-06-09T15:51:03.000-07:00
The first 4 bytes of data to be sent are stored additionally into
the message class field of the send request. A receiving target
program (not an af_iucv socket program) can make use of this
information to pre-screen incoming messages.

Signed-off-by: Ursula Braun &lt;braunu@de.ibm.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
@@ -644,6 +644,7 @@ static int iucv_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 		}
 
 		txmsg.class = 0;
+		memcpy(&txmsg.class, skb->data, skb->len >= 4 ? 4 : skb->len);
 		txmsg.tag = iucv->send_tag++;
 		memcpy(skb->cb, &txmsg.tag, 4);
 		skb_queue_tail(&iucv->send_skb_q, skb);

Original file line number	Diff line number	Diff line change
`@@ -644,6 +644,7 @@ static int iucv_sock_sendmsg(struct kiocb iocb, struct socket sock,`
`644`	`644`	`}`
`645`	`645`
`646`	`646`	`txmsg.class = 0;`
	`647`	`+ memcpy(&txmsg.class, skb->data, skb->len >= 4 ? 4 : skb->len);`
`647`	`648`	`txmsg.tag = iucv->send_tag++;`
`648`	`649`	`memcpy(skb->cb, &txmsg.tag, 4);`
`649`	`650`	`skb_queue_tail(&iucv->send_skb_q, skb);`