Re: [PATCH] tipc: reinitialize pointer after skb linearize

[Ying Xue <ying.xue@windriver.com>]

On 09/18/2015 04:46 PM, erik.hugne@ericsson.com wrote:
> From: Erik Hugne <erik.hugne@ericsson.com>
> 
> The msg pointer into header may change after skb linearization.
> We must reinitialize it after calling skb_linearize to prevent
> operating on a freed or invalid pointer.
> 
> Signed-off-by: Erik Hugne <erik.hugne@ericsson.com>
> Reported-by: Tamás Végh <tamas.vegh@ericsson.com>

Acked-by: Ying Xue <ying.xue@windriver.com>

> ---
>  net/tipc/msg.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/tipc/msg.c b/net/tipc/msg.c
> index 562c926..c5ac436 100644
> --- a/net/tipc/msg.c
> +++ b/net/tipc/msg.c
> @@ -539,6 +539,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
>  	*err = -TIPC_ERR_NO_NAME;
>  	if (skb_linearize(skb))
>  		return false;
> +	msg = buf_msg(skb);
>  	if (msg_reroute_cnt(msg))
>  		return false;
>  	dnode = addr_domain(net, msg_lookup_scope(msg));
> 


------------------------------------------------------------------------------
_______________________________________________
tipc-discussion mailing list
tipc-discussion@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tipc-discussion