From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jon Maloy Subject: [net 1/1] tipc: eliminate access after delete in group_filter_msg() Date: Mon, 27 Nov 2017 20:13:39 +0100 Message-ID: <1511810019-8968-1-git-send-email-jon.maloy@ericsson.com> Mime-Version: 1.0 Content-Type: text/plain Cc: , , , , , , To: , Return-path: Received: from sesbmg23.ericsson.net ([193.180.251.37]:50431 "EHLO sesbmg23.ericsson.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751767AbdK0TNt (ORCPT ); Mon, 27 Nov 2017 14:13:49 -0500 Sender: netdev-owner@vger.kernel.org List-ID: KASAN revealed another access after delete in group.c. This time it found that we read the header of a received message after the buffer has been released. Signed-off-by: Jon Maloy --- net/tipc/group.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index 12777ca..95fec2c 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -497,6 +497,7 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq, while ((skb = skb_peek(defq))) { hdr = buf_msg(skb); mtyp = msg_type(hdr); + blks = msg_blocks(hdr); deliver = true; ack = false; update = false; @@ -546,7 +547,6 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq, if (!update) continue; - blks = msg_blocks(hdr); tipc_group_update_rcv_win(grp, blks, node, port, xmitq); } return; -- 2.1.4