Commit 4e3ae001 authored Sep 18, 2015 by Erik Hugne Committed by David S. Miller Sep 20, 2015

tipc: reinitialize pointer after skb linearize



The msg pointer into header may change after skb linearization.
We must reinitialize it after calling skb_linearize to prevent
operating on a freed or invalid pointer.

Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
Reported-by: Tamás Végh <tamas.vegh@ericsson.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent aab0c0e6

net/tipc/msg.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -539,6 +539,7 @@ bool tipc_msg_lookup_dest(struct net net, struct sk_buff skb, int *err)
		*err = -TIPC_ERR_NO_NAME;
		if (skb_linearize(skb))
		return false;
		msg = buf_msg(skb);
		if (msg_reroute_cnt(msg))
		return false;
		dnode = addr_domain(net, msg_lookup_scope(msg));