summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorErik Hugne <erik.hugne@ericsson.com>2015-09-18 11:46:31 +0300
committerDavid S. Miller <davem@davemloft.net>2015-09-21 08:31:20 +0300
commit4e3ae00100945d39e1f83b7c0179a114ccf55759 (patch)
tree0d911950c7ea216376f756cd1e4d33a7ce9ba449
parentaab0c0e62ec4af224d1b6b40fca65055d403400b (diff)
downloadlinux-4e3ae00100945d39e1f83b7c0179a114ccf55759.tar.xz
tipc: reinitialize pointer after skb linearize
The msg pointer into header may change after skb linearization. We must reinitialize it after calling skb_linearize to prevent operating on a freed or invalid pointer. Signed-off-by: Erik Hugne <erik.hugne@ericsson.com> Reported-by: Tamás Végh <tamas.vegh@ericsson.com> Acked-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/tipc/msg.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 562c926a51cc..c5ac436235e0 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -539,6 +539,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
*err = -TIPC_ERR_NO_NAME;
if (skb_linearize(skb))
return false;
+ msg = buf_msg(skb);
if (msg_reroute_cnt(msg))
return false;
dnode = addr_domain(net, msg_lookup_scope(msg));