From e233df01576bba9f5bafacccd571353b72152bd5 Mon Sep 17 00:00:00 2001 From: Cong Wang Date: Tue, 24 Oct 2017 15:44:49 -0700 Subject: tipc: fix a dangling pointer tsk->group is set to grp earlier, but we forget to unset it after grp is freed. Fixes: 75da2163dbb6 ("tipc: introduce communication groups") Reported-by: syzkaller bot Cc: Jon Maloy Cc: Ying Xue Signed-off-by: Cong Wang Signed-off-by: David S. Miller --- net/tipc/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'net/tipc/socket.c') diff --git a/net/tipc/socket.c b/net/tipc/socket.c index b3b72d8e9543..ea61c32f6b80 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct tipc_group_req *mreq) seq.upper = seq.lower; tipc_nametbl_build_group(net, grp, mreq->type, domain); rc = tipc_sk_publish(tsk, mreq->scope, &seq); - if (rc) + if (rc) { tipc_group_delete(net, grp); + tsk->group = NULL; + } /* Eliminate any risk that a broadcast overtakes the sent JOIN */ tsk->mc_method.rcast = true; -- cgit v1.2.3-59-g8ed1b