diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2017-10-24 15:44:49 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-10-26 17:46:53 +0900 |
| commit | e233df01576bba9f5bafacccd571353b72152bd5 (patch) | |
| tree | e67220d57359519a806ac70d894b423b2c14ca84 | |
| parent | c1eef220c1760762753b602c382127bfccee226d (diff) | |
tipc: fix a dangling pointer
tsk->group is set to grp earlier, but we forget to unset it
after grp is freed.
Fixes: 75da2163dbb6 ("tipc: introduce communication groups")
Reported-by: syzkaller bot
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/tipc/socket.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/tipc/socket.c b/net/tipc/socket.c index b3b72d8e9543..ea61c32f6b80 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct tipc_group_req *mreq) seq.upper = seq.lower; tipc_nametbl_build_group(net, grp, mreq->type, domain); rc = tipc_sk_publish(tsk, mreq->scope, &seq); - if (rc) + if (rc) { tipc_group_delete(net, grp); + tsk->group = NULL; + } /* Eliminate any risk that a broadcast overtakes the sent JOIN */ tsk->mc_method.rcast = true; |