tipc: fix use-after-free in tipc_disc_rcv()
authorTuong Lien <tuong.t.lien@dektech.com.au>
Tue, 10 Dec 2019 08:21:05 +0000 (15:21 +0700)
committerDavid S. Miller <davem@davemloft.net>
Wed, 11 Dec 2019 01:45:04 +0000 (17:45 -0800)
commit31e4ccc99eda8a5a7e6902c98bee6e78ffd3edb9
tree5d8a20136f6e21f51bf569332b008a9fbb69527b
parentabc9b4e0549b93fdaff56e9532bc49a2d7b04955
tipc: fix use-after-free in tipc_disc_rcv()

In the function 'tipc_disc_rcv()', the 'msg_peer_net_hash()' is called
to read the header data field but after the message skb has been freed,
that might result in a garbage value...

This commit fixes it by defining a new local variable to store the data
first, just like the other header fields' handling.

Fixes: f73b12812a3d ("tipc: improve throughput between nodes in netns")
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/discover.c