netdev - RE: [Patch net-next] tipc: fix a dangling pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 25 Oct 2017 07:58:09 +0000
From:   Jon Maloy <jon.maloy@...csson.com>
To:     Cong Wang <xiyou.wangcong@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     Ying Xue <ying.xue@...driver.com>
Subject: RE: [Patch net-next] tipc: fix a dangling pointer

Acked. Thank you.

///jon

> -----Original Message-----
> From: Cong Wang [mailto:xiyou.wangcong@...il.com]
> Sent: Wednesday, October 25, 2017 00:45
> To: netdev@...r.kernel.org
> Cc: Cong Wang <xiyou.wangcong@...il.com>; Jon Maloy
> <jon.maloy@...csson.com>; Ying Xue <ying.xue@...driver.com>
> Subject: [Patch net-next] tipc: fix a dangling pointer
> 
> tsk->group is set to grp earlier, but we forget to unset it
> after grp is freed.
> 
> Fixes: 75da2163dbb6 ("tipc: introduce communication groups")
> Reported-by: syzkaller bot
> Cc: Jon Maloy <jon.maloy@...csson.com>
> Cc: Ying Xue <ying.xue@...driver.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>
> ---
>  net/tipc/socket.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/net/tipc/socket.c b/net/tipc/socket.c index
> b3b72d8e9543..ea61c32f6b80 100644
> --- a/net/tipc/socket.c
> +++ b/net/tipc/socket.c
> @@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct
> tipc_group_req *mreq)
>  	seq.upper = seq.lower;
>  	tipc_nametbl_build_group(net, grp, mreq->type, domain);
>  	rc = tipc_sk_publish(tsk, mreq->scope, &seq);
> -	if (rc)
> +	if (rc) {
>  		tipc_group_delete(net, grp);
> +		tsk->group = NULL;
> +	}
> 
>  	/* Eliminate any risk that a broadcast overtakes the sent JOIN */
>  	tsk->mc_method.rcast = true;
> --
> 2.13.0