From a21b7ddc5a90868eda665c69004c43b37beea6ca Mon Sep 17 00:00:00 2001 From: Enrico Scholz Date: Tue, 30 Aug 2022 09:38:15 +0200 Subject: tftp: accept OACK + DATA datagrams only in certain states These packets are valid in certain points of the transfer only and accepting them too early or too late can corrupt internal states. Reject them when they are unexpected. Signed-off-by: Enrico Scholz Link: https://lore.barebox.org/20220830073816.2694734-21-enrico.scholz@sigma-chemnitz.de Signed-off-by: Sascha Hauer --- fs/tftp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/tftp.c b/fs/tftp.c index 37180b8675..ada6ad08de 100644 --- a/fs/tftp.c +++ b/fs/tftp.c @@ -717,6 +717,12 @@ static void tftp_recv(struct file_priv *priv, break; case TFTP_OACK: + if (priv->state != STATE_RRQ && priv->state != STATE_WRQ) { + pr_warn("OACK packet in %s state\n", + tftp_states[priv->state]); + break; + } + priv->tftp_con->udp->uh_dport = uh_sport; if (tftp_parse_oack(priv, pkt, len) < 0) { @@ -745,6 +751,12 @@ static void tftp_recv(struct file_priv *priv, break; } + if (priv->state != STATE_RDATA) { + pr_warn("DATA packet in %s state\n", + tftp_states[priv->state]); + break; + } + tftp_handle_data(priv, block, pkt + 2, len); break; -- cgit v1.2.3