Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e724dca authored by Jon Maloy's avatar Jon Maloy Committed by David S. Miller
Browse files

tipc: eliminate access after delete in group_filter_msg() 



KASAN revealed another access after delete in group.c. This time
it found that we read the header of a received message after the
buffer has been released.

Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b5971df

net/tipc/group.c

+1 −1
Original line number Diff line number Diff line
@@ -497,6 +497,7 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq, 
	while ((skb = skb_peek(defq))) {

		hdr = buf_msg(skb);

		mtyp = msg_type(hdr);

		blks = msg_blocks(hdr);

		deliver = true;

		ack = false;

		update = false;
@@ -546,7 +547,6 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq, 
		if (!update)

			continue;



		blks = msg_blocks(hdr);

		tipc_group_update_rcv_win(grp, blks, node, port, xmitq);

	}

	return;