diff options
| author | Tuong Lien <tuong.t.lien@dektech.com.au> | 2019-12-10 15:21:05 +0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-18 11:42:06 +0100 |
| commit | 3188f80b80d62823d3e3a6539b5216dd89e6250c (patch) | |
| tree | 3c5208b10e8436f7003121d1c35804e554a9690d /net/tipc | |
| parent | 3eeb06132d361423146fdbfc64e5e8149f8fa0c6 (diff) | |
tipc: fix use-after-free in tipc_disc_rcv()
commit 31e4ccc99eda8a5a7e6902c98bee6e78ffd3edb9 upstream.
In the function 'tipc_disc_rcv()', the 'msg_peer_net_hash()' is called
to read the header data field but after the message skb has been freed,
that might result in a garbage value...
This commit fixes it by defining a new local variable to store the data
first, just like the other header fields' handling.
Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns")
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/tipc')
| -rw-r--r-- | net/tipc/discover.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/tipc/discover.c b/net/tipc/discover.c index 61b80de93489..9c64567f8a74 100644 --- a/net/tipc/discover.c +++ b/net/tipc/discover.c @@ -194,6 +194,7 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb, { struct tipc_net *tn = tipc_net(net); struct tipc_msg *hdr = buf_msg(skb); + u32 pnet_hash = msg_peer_net_hash(hdr); u16 caps = msg_node_capabilities(hdr); bool legacy = tn->legacy_addr_format; u32 sugg = msg_sugg_node_addr(hdr); @@ -245,9 +246,8 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb, return; if (!tipc_in_scope(legacy, b->domain, src)) return; - tipc_node_check_dest(net, src, peer_id, b, caps, signature, - msg_peer_net_hash(hdr), &maddr, &respond, - &dupl_addr); + tipc_node_check_dest(net, src, peer_id, b, caps, signature, pnet_hash, + &maddr, &respond, &dupl_addr); if (dupl_addr) disc_dupl_alert(b, src, &maddr); if (!respond) |