Subject: Re: [syzbot] KASAN: use-after-free Read in tipc_recvmsg

From: Pavel Skripkin <[email-masked]>
Date: Fri, 23 Jul 2021 19:52:53 +0300

On Fri, 23 Jul 2021 12:41:46 -0400
Xin Long <[email-masked]> wrote:

> a fix already posted in tipc-discussion:
> 
> diff --git a/net/tipc/socket.c b/net/tipc/socket.c
> index 9b0b311c7ec1..b0dd183a4dbc 100644
> --- a/net/tipc/socket.c
> +++ b/net/tipc/socket.c
> @@ -1973,10 +1973,12 @@ static int tipc_recvmsg(struct socket *sock,
> struct msghdr *m,
>                 tipc_node_distr_xmit(sock_net(sk), &xmitq);
>         }
> 
> -       if (!skb_cb->bytes_read)
> -               tsk_advance_rx_queue(sk);
> +       if (skb_cb->bytes_read)
> +               goto exit;
> +
> +       tsk_advance_rx_queue(sk);
> 
> -       if (likely(!connected) || skb_cb->bytes_read)
> +       if (likely(!connected))
>                 goto exit;
> 

Ok, thank you for informing

With regards,
Pavel Skripkin