GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-07 07:08:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

tipc: fix use-after-free in tipc_disc_rcv()

Browse source 
In the function 'tipc_disc_rcv()', the 'msg_peer_net_hash()' is called
to read the header data field but after the message skb has been freed,
that might result in a garbage value...

This commit fixes it by defining a new local variable to store the data
first, just like the other header fields' handling.

Fixes: f73b12812a ("tipc: improve throughput between nodes in netns")
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Tuong Lien 2019-12-10 15:21:05 +07:00 • committed by David S. Miller
parent abc9b4e054
commit 31e4ccc99e
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
net/tipc/discover.c
View file

@ -194,6 +194,7 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb,
{ {
struct tipc_net *tn = tipc_net(net); struct tipc_net *tn = tipc_net(net);
struct tipc_msg *hdr = buf_msg(skb); struct tipc_msg *hdr = buf_msg(skb);
u32 pnet_hash = msg_peer_net_hash(hdr);
u16 caps = msg_node_capabilities(hdr); u16 caps = msg_node_capabilities(hdr);
bool legacy = tn->legacy_addr_format; bool legacy = tn->legacy_addr_format;
u32 sugg = msg_sugg_node_addr(hdr); u32 sugg = msg_sugg_node_addr(hdr);
@ -242,9 +243,8 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb,
return; return;
if (!tipc_in_scope(legacy, b->domain, src)) if (!tipc_in_scope(legacy, b->domain, src))
return; return;
tipc_node_check_dest(net, src, peer_id, b, caps, signature, tipc_node_check_dest(net, src, peer_id, b, caps, signature, pnet_hash,
msg_peer_net_hash(hdr), &maddr, &respond, &maddr, &respond, &dupl_addr);
&dupl_addr);
if (dupl_addr) if (dupl_addr)
disc_dupl_alert(b, src, &maddr); disc_dupl_alert(b, src, &maddr);
if (!respond) if (!respond)