netdev - Re: [tipc-discussion] [PATCH] tipc: reinitialize pointer after skb linearize

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 18 Sep 2015 17:44:02 +0800
From:	Ying Xue <ying.xue@...driver.com>
To:	<erik.hugne@...csson.com>, <netdev@...r.kernel.org>
CC:	<tipc-discussion@...ts.sourceforge.net>
Subject: Re: [tipc-discussion] [PATCH] tipc: reinitialize pointer after skb
 linearize

On 09/18/2015 04:46 PM, erik.hugne@...csson.com wrote:
> From: Erik Hugne <erik.hugne@...csson.com>
> 
> The msg pointer into header may change after skb linearization.
> We must reinitialize it after calling skb_linearize to prevent
> operating on a freed or invalid pointer.
> 
> Signed-off-by: Erik Hugne <erik.hugne@...csson.com>
> Reported-by: Tamás Végh <tamas.vegh@...csson.com>

Acked-by: Ying Xue <ying.xue@...driver.com>

> ---
>  net/tipc/msg.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/tipc/msg.c b/net/tipc/msg.c
> index 562c926..c5ac436 100644
> --- a/net/tipc/msg.c
> +++ b/net/tipc/msg.c
> @@ -539,6 +539,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
>  	*err = -TIPC_ERR_NO_NAME;
>  	if (skb_linearize(skb))
>  		return false;
> +	msg = buf_msg(skb);
>  	if (msg_reroute_cnt(msg))
>  		return false;
>  	dnode = addr_domain(net, msg_lookup_scope(msg));
> 

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html