>From 9f81f8574bfc1183209022b405848e01c35b86e6 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 23 Jul 2021 19:34:06 +0300
Subject: [PATCH] tipc: fix use-after-free in tipc_recvmsg

/* .. */

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 net/tipc/socket.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 9b0b311c7ec1..0cf2468d209d 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1886,6 +1886,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 	struct sk_buff *skb;
 	bool grp_evt;
 	long timeout;
+	unsigned int bytes_read;
 
 	/* Catch invalid receive requests */
 	if (unlikely(!buflen))
@@ -1973,10 +1974,13 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 		tipc_node_distr_xmit(sock_net(sk), &xmitq);
 	}
 
-	if (!skb_cb->bytes_read)
+	/* To avoid accesing skb_cb after tsk_advance_rx_queue */
+	bytes_read = skb_cb->bytes_read;
+
+	if (!bytes_read)
 		tsk_advance_rx_queue(sk);
 
-	if (likely(!connected) || skb_cb->bytes_read)
+	if (likely(!connected) || bytes_read)
 		goto exit;
 
 	/* Send connection flow control advertisement when applicable */
-- 
2.32.0