* [net 1/1] tipc: fix access of released memory
@ 2017-11-20 20:43 Jon Maloy
2017-11-21 11:22 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Jon Maloy @ 2017-11-20 20:43 UTC (permalink / raw)
To: davem, netdev
Cc: mohan.krishna.ghanta.krishnamurthy, tung.q.nguyen, hoang.h.le,
jon.maloy, canh.d.luu, ying.xue, tipc-discussion
When the function tipc_group_filter_msg() finds that a member event
indicates that the member is leaving the group, it first deletes the
member instance, and then purges the message queue being handled
by the call. But the message queue is an aggregated field in the
just deleted item, leading the purge call to access freed memory.
We fix this by swapping the order of the two actions.
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
---
net/tipc/group.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 7821085..12777ca 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -539,8 +539,8 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
tipc_group_proto_xmit(grp, m, GRP_ACK_MSG, xmitq);
if (leave) {
- tipc_group_delete_member(grp, m);
__skb_queue_purge(defq);
+ tipc_group_delete_member(grp, m);
break;
}
if (!update)
--
2.1.4
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [net 1/1] tipc: fix access of released memory
2017-11-20 20:43 [net 1/1] tipc: fix access of released memory Jon Maloy
@ 2017-11-21 11:22 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2017-11-21 11:22 UTC (permalink / raw)
To: jon.maloy
Cc: netdev, mohan.krishna.ghanta.krishnamurthy, tung.q.nguyen,
hoang.h.le, canh.d.luu, ying.xue, tipc-discussion
From: Jon Maloy <jon.maloy@ericsson.com>
Date: Mon, 20 Nov 2017 21:43:03 +0100
> When the function tipc_group_filter_msg() finds that a member event
> indicates that the member is leaving the group, it first deletes the
> member instance, and then purges the message queue being handled
> by the call. But the message queue is an aggregated field in the
> just deleted item, leading the purge call to access freed memory.
>
> We fix this by swapping the order of the two actions.
>
> Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Applied, thanks Jon.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-11-21 11:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-11-20 20:43 [net 1/1] tipc: fix access of released memory Jon Maloy
2017-11-21 11:22 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).