From: Hoang Le <hoang.h...@dektech.com.au>
Date: Thu, 21 Mar 2019 17:25:17 +0700
> skb free-ed in:
> 1/ condition 1: tipc_sk_filter_rcv -> tipc_sk_proto_rcv
> 2/ condition 2: tipc_sk_filter_rcv -> tipc_group_filter_msg
> This leads to a "use-after-free" access in the next condition.
>
> We fix this by intializing the variable at declaration, then it is safe
> to check this variable to continue processing if condition matches.
>
> syzbot report:
...
> Reported-by: syzbot+e863893591cc7a622...@syzkaller.appspotmail.com
> Fixes: c55c8eda ("tipc: smooth change between replicast and broadcast")
> Acked-by: Jon Maloy <jon.ma...@ericsson.com>
> Signed-off-by: Hoang Le <hoang.h...@dektech.com.au>
Applied.
_______________________________________________
tipc-discussion mailing list
tipc-discussion@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tipc-discussion
