From 9f81f8574bfc1183209022b405848e01c35b86e6 Mon Sep 17 00:00:00 2001 From: Pavel Skripkin Date: Fri, 23 Jul 2021 19:34:06 +0300 Subject: [PATCH] tipc: fix use-after-free in tipc_recvmsg /* .. */ Signed-off-by: Pavel Skripkin --- net/tipc/socket.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 9b0b311c7ec1..0cf2468d209d 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1886,6 +1886,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, struct sk_buff *skb; bool grp_evt; long timeout; + unsigned int bytes_read; /* Catch invalid receive requests */ if (unlikely(!buflen)) @@ -1973,10 +1974,13 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, tipc_node_distr_xmit(sock_net(sk), &xmitq); } - if (!skb_cb->bytes_read) + /* To avoid accesing skb_cb after tsk_advance_rx_queue */ + bytes_read = skb_cb->bytes_read; + + if (!bytes_read) tsk_advance_rx_queue(sk); - if (likely(!connected) || skb_cb->bytes_read) + if (likely(!connected) || bytes_read) goto exit; /* Send connection flow control advertisement when applicable */ -- 2.32.0