summaryrefslogtreecommitdiff
path: root/net/tipc
diff options
context:
space:
mode:
authorCong Wang <xiyou.wangcong@gmail.com>2017-10-24 15:44:49 -0700
committerDavid S. Miller <davem@davemloft.net>2017-10-26 17:46:53 +0900
commite233df01576bba9f5bafacccd571353b72152bd5 (patch)
treee67220d57359519a806ac70d894b423b2c14ca84 /net/tipc
parentc1eef220c1760762753b602c382127bfccee226d (diff)
tipc: fix a dangling pointer
tsk->group is set to grp earlier, but we forget to unset it after grp is freed. Fixes: 75da2163dbb6 ("tipc: introduce communication groups") Reported-by: syzkaller bot Cc: Jon Maloy <jon.maloy@ericsson.com> Cc: Ying Xue <ying.xue@windriver.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
-rw-r--r--net/tipc/socket.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b3b72d8e9543..ea61c32f6b80 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2756,8 +2756,10 @@ static int tipc_sk_join(struct tipc_sock *tsk, struct tipc_group_req *mreq)
seq.upper = seq.lower;
tipc_nametbl_build_group(net, grp, mreq->type, domain);
rc = tipc_sk_publish(tsk, mreq->scope, &seq);
- if (rc)
+ if (rc) {
tipc_group_delete(net, grp);
+ tsk->group = NULL;
+ }
/* Eliminate any risk that a broadcast overtakes the sent JOIN */
tsk->mc_method.rcast = true;