]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
tipc: fix use-after-free in tipc_disc_rcv()
authorTuong Lien <tuong.t.lien@dektech.com.au>
Tue, 10 Dec 2019 08:21:05 +0000 (15:21 +0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 11 Dec 2019 01:45:04 +0000 (17:45 -0800)
In the function 'tipc_disc_rcv()', the 'msg_peer_net_hash()' is called
to read the header data field but after the message skb has been freed,
that might result in a garbage value...

This commit fixes it by defining a new local variable to store the data
first, just like the other header fields' handling.

Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns")
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/discover.c

index b043e8c6397a8d19b5f6ed40df09f5a561f0ee23..bfe43da127c04a702a5c191a7a699e4fb154c718 100644 (file)
@@ -194,6 +194,7 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb,
 {
        struct tipc_net *tn = tipc_net(net);
        struct tipc_msg *hdr = buf_msg(skb);
+       u32 pnet_hash = msg_peer_net_hash(hdr);
        u16 caps = msg_node_capabilities(hdr);
        bool legacy = tn->legacy_addr_format;
        u32 sugg = msg_sugg_node_addr(hdr);
@@ -242,9 +243,8 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb,
                return;
        if (!tipc_in_scope(legacy, b->domain, src))
                return;
-       tipc_node_check_dest(net, src, peer_id, b, caps, signature,
-                            msg_peer_net_hash(hdr), &maddr, &respond,
-                            &dupl_addr);
+       tipc_node_check_dest(net, src, peer_id, b, caps, signature, pnet_hash,
+                            &maddr, &respond, &dupl_addr);
        if (dupl_addr)
                disc_dupl_alert(b, src, &maddr);
        if (!respond)