Commit e233df01 authored Oct 24, 2017 by Cong Wang Committed by David S. Miller Oct 26, 2017

tipc: fix a dangling pointer

tsk->group is set to grp earlier, but we forget to unset it
after grp is freed.

Fixes: 75da2163 ("tipc: introduce communication groups")
Reported-by: syzkaller bot
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c1eef220

net/tipc/socket.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock tsk, struct tipc_group_req mreq)
		seq.upper = seq.lower;
		tipc_nametbl_build_group(net, grp, mreq->type, domain);
		rc = tipc_sk_publish(tsk, mreq->scope, &seq);
		if (rc)
		if (rc) {
		tipc_group_delete(net, grp);
		tsk->group = NULL;
		}

		/* Eliminate any risk that a broadcast overtakes the sent JOIN */
		tsk->mc_method.rcast = true;