OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tipc: fix a dangling pointer 

tsk->group is set to grp earlier, but we forget to unset it
after grp is freed.

Fixes: 75da2163db ("tipc: introduce communication groups")
Reported-by: syzkaller bot
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Cong Wang 2017-10-24 15:44:49 -07:00 committed by David S. Miller
parent c1eef220c1
commit e233df0157
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/tipc/socket.c
View File

@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct tipc_group_req *mreq)
seq.upper = seq.lower;
tipc_nametbl_build_group(net, grp, mreq->type, domain);
rc = tipc_sk_publish(tsk, mreq->scope, &seq);
if (rc)
if (rc) {
tipc_group_delete(net, grp);
tsk->group = NULL;
}
/* Eliminate any risk that a broadcast overtakes the sent JOIN */
tsk->mc_method.rcast = true;