* [Patch net-next] tipc: fix a dangling pointer
@ 2017-10-24 22:44 Cong Wang
2017-10-25 7:58 ` Jon Maloy
2017-10-26 8:48 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Cong Wang @ 2017-10-24 22:44 UTC (permalink / raw)
To: netdev; +Cc: Cong Wang, Jon Maloy, Ying Xue
tsk->group is set to grp earlier, but we forget to unset it
after grp is freed.
Fixes: 75da2163dbb6 ("tipc: introduce communication groups")
Reported-by: syzkaller bot
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
net/tipc/socket.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b3b72d8e9543..ea61c32f6b80 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct tipc_group_req *mreq)
seq.upper = seq.lower;
tipc_nametbl_build_group(net, grp, mreq->type, domain);
rc = tipc_sk_publish(tsk, mreq->scope, &seq);
- if (rc)
+ if (rc) {
tipc_group_delete(net, grp);
+ tsk->group = NULL;
+ }
/* Eliminate any risk that a broadcast overtakes the sent JOIN */
tsk->mc_method.rcast = true;
--
2.13.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* RE: [Patch net-next] tipc: fix a dangling pointer
2017-10-24 22:44 [Patch net-next] tipc: fix a dangling pointer Cong Wang
@ 2017-10-25 7:58 ` Jon Maloy
2017-10-26 8:48 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Jon Maloy @ 2017-10-25 7:58 UTC (permalink / raw)
To: Cong Wang, netdev@vger.kernel.org; +Cc: Ying Xue
Acked. Thank you.
///jon
> -----Original Message-----
> From: Cong Wang [mailto:xiyou.wangcong@gmail.com]
> Sent: Wednesday, October 25, 2017 00:45
> To: netdev@vger.kernel.org
> Cc: Cong Wang <xiyou.wangcong@gmail.com>; Jon Maloy
> <jon.maloy@ericsson.com>; Ying Xue <ying.xue@windriver.com>
> Subject: [Patch net-next] tipc: fix a dangling pointer
>
> tsk->group is set to grp earlier, but we forget to unset it
> after grp is freed.
>
> Fixes: 75da2163dbb6 ("tipc: introduce communication groups")
> Reported-by: syzkaller bot
> Cc: Jon Maloy <jon.maloy@ericsson.com>
> Cc: Ying Xue <ying.xue@windriver.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> ---
> net/tipc/socket.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/tipc/socket.c b/net/tipc/socket.c index
> b3b72d8e9543..ea61c32f6b80 100644
> --- a/net/tipc/socket.c
> +++ b/net/tipc/socket.c
> @@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct
> tipc_group_req *mreq)
> seq.upper = seq.lower;
> tipc_nametbl_build_group(net, grp, mreq->type, domain);
> rc = tipc_sk_publish(tsk, mreq->scope, &seq);
> - if (rc)
> + if (rc) {
> tipc_group_delete(net, grp);
> + tsk->group = NULL;
> + }
>
> /* Eliminate any risk that a broadcast overtakes the sent JOIN */
> tsk->mc_method.rcast = true;
> --
> 2.13.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Patch net-next] tipc: fix a dangling pointer
2017-10-24 22:44 [Patch net-next] tipc: fix a dangling pointer Cong Wang
2017-10-25 7:58 ` Jon Maloy
@ 2017-10-26 8:48 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-10-26 8:48 UTC (permalink / raw)
To: xiyou.wangcong; +Cc: netdev, jon.maloy, ying.xue
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Tue, 24 Oct 2017 15:44:49 -0700
> tsk->group is set to grp earlier, but we forget to unset it
> after grp is freed.
>
> Fixes: 75da2163dbb6 ("tipc: introduce communication groups")
> Reported-by: syzkaller bot
> Cc: Jon Maloy <jon.maloy@ericsson.com>
> Cc: Ying Xue <ying.xue@windriver.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-10-26 8:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-24 22:44 [Patch net-next] tipc: fix a dangling pointer Cong Wang
2017-10-25 7:58 ` Jon Maloy
2017-10-26 8:48 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).