[PATCH 1/1] tipc: fix double-free in tipc_buf_append()

[Lee Jones <lee@kernel.org>]

The tipc_msg_validate() function can potentially reallocate the skb it
is validating, freeing the old one.  In tipc_buf_append(), it was being
called with a pointer to a local variable which was a copy of the
caller's skb pointer.

If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.

Fix this by passing the caller's skb pointer-pointer directly to
tipc_msg_validate(), ensuring any modification is reflected correctly.
The local skb pointer is then updated from the (possibly modified)
caller's pointer.

Fixes: d618d09a68e4 ("tipc: enforce valid ratio between skb truesize and contents")
Assisted-by: Gemini:gemini-3.1-pro-preview
Signed-off-by: Lee Jones <lee@kernel.org>
---
 net/tipc/msg.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 76284fc538eb..9f4f612ee027 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -177,8 +177,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
 
 	if (fragid == LAST_FRAGMENT) {
 		TIPC_SKB_CB(head)->validated = 0;
-		if (unlikely(!tipc_msg_validate(&head)))
+		if (unlikely(!tipc_msg_validate(headbuf)))
 			goto err;
+		head = *headbuf;
 		*buf = head;
 		TIPC_SKB_CB(head)->tail = NULL;
 		*headbuf = NULL;
-- 
2.54.0.rc1.513.gad8abe7a5a-goog