tipc: eliminate access after delete in group_filter_msg()

KASAN revealed another access after delete in group.c. This time
it found that we read the header of a received message after the
buffer has been released.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 1 insertions, 1 deletions

diff --git a/net/tipc/group.c b/net/tipc/group.c
index 12777cac638a..95fec2c057d6 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -497,6 +497,7 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
         while ((skb = skb_peek(defq))) {
                 hdr = buf_msg(skb);
                 mtyp = msg_type(hdr);
+                blks = msg_blocks(hdr);
                 deliver = true;
                 ack = false;
                 update = false;
@@ -546,7 +547,6 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
                 if (!update)
                         continue;
 
-                blks = msg_blocks(hdr);
                 tipc_group_update_rcv_win(grp, blks, node, port, xmitq);
         }
         return;