diff options
| author |   Cong Wang <xiyou.wangcong@gmail.com> | 2018-12-11 21:43:51 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-12-14 15:48:49 -0800 |
| commit | 143ece654f9f5b37bedea252a990be37e48ae3a5 (patch) | |
| tree | 3268762e6be9aa0bbb5a1a6de35e77d67e08175b /include/linux | |
| parent | net: Allow class-e address assignment via ifconfig ioctl (diff) | |
| download | linux-dev-143ece654f9f5b37bedea252a990be37e48ae3a5.tar.xz linux-dev-143ece654f9f5b37bedea252a990be37e48ae3a5.zip | |
tipc: check tsk->group in tipc_wait_for_cond()
tipc_wait_for_cond() drops socket lock before going to sleep,
but tsk->group could be freed right after that release_sock().
So we have to re-check and reload tsk->group after it wakes up.
After this patch, tipc_wait_for_cond() returns -ERESTARTSYS when
tsk->group is NULL, instead of continuing with the assumption of
a non-NULL tsk->group.
(It looks like 'dsts' should be re-checked and reloaded too, but
it is a different bug.)
Similar for tipc_send_group_unicast() and tipc_send_group_anycast().
Reported-by: syzbot+10a9db47c3a0e13eb31c@syzkaller.appspotmail.com
Fixes: b7d42635517f ("tipc: introduce flow control for group broadcast messages")
Fixes: ee106d7f942d ("tipc: introduce group anycast messaging")
Fixes: 27bd9ec027f3 ("tipc: introduce group unicast messaging")
Cc: Ying Xue <ying.xue@windriver.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions