Commit 2e724dca authored by Jon Maloy's avatar Jon Maloy Committed by David S. Miller

tipc: eliminate access after delete in group_filter_msg()

KASAN revealed another access after delete in group.c. This time
it found that we read the header of a received message after the
buffer has been released.
Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5b5971df
...@@ -497,6 +497,7 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq, ...@@ -497,6 +497,7 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
while ((skb = skb_peek(defq))) { while ((skb = skb_peek(defq))) {
hdr = buf_msg(skb); hdr = buf_msg(skb);
mtyp = msg_type(hdr); mtyp = msg_type(hdr);
blks = msg_blocks(hdr);
deliver = true; deliver = true;
ack = false; ack = false;
update = false; update = false;
...@@ -546,7 +547,6 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq, ...@@ -546,7 +547,6 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
if (!update) if (!update)
continue; continue;
blks = msg_blocks(hdr);
tipc_group_update_rcv_win(grp, blks, node, port, xmitq); tipc_group_update_rcv_win(grp, blks, node, port, xmitq);
} }
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment