]> git.baikalelectronics.ru Git - kernel.git/commit
tipc: fix use-after-free in tipc_disc_rcv()
authorTuong Lien <tuong.t.lien@dektech.com.au>
Tue, 10 Dec 2019 08:21:05 +0000 (15:21 +0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 18 Jan 2023 10:42:06 +0000 (11:42 +0100)
commit96efd38486acf3d6d15a8bb86ea7e5d7329739ec
tree3c5208b10e8436f7003121d1c35804e554a9690d
parentee3ccad1f9993ca6cd287a5bc7dda95e19c9a619
tipc: fix use-after-free in tipc_disc_rcv()

commit 0688594b66904067686bef63a9f24b172845f0ec upstream.

In the function 'tipc_disc_rcv()', the 'msg_peer_net_hash()' is called
to read the header data field but after the message skb has been freed,
that might result in a garbage value...

This commit fixes it by defining a new local variable to store the data
first, just like the other header fields' handling.

Fixes: 5248c6f8694f ("tipc: improve throughput between nodes in netns")
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/tipc/discover.c