tipc: check group dests after tipc_wait_for_cond() (3c6306d4) · Commits · 戴 / test

Similar to commit ("tipc: check tsk->group in tipc_wait_for_cond()") we have to reload grp->dests too after we re-take the sock lock. This means we need to move the dsts check after tipc_wait_for_cond() too. Fixes: ("tipc: introduce communication groups") Reported-and-tested-by:

<syzbot+99f20222fc5018d2b97a@syzkaller.appspotmail.com> Cc: Ying Xue <ying.xue@windriver.com> Cc: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by:

Cong Wang <xiyou.wangcong@gmail.com> Acked-by:

Jon Maloy <jon.maloy@ericsson.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/tipc/socket.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -1009,7 +1009,7 @@ static int tipc_send_group_bcast(struct socket sock, struct msghdr m,
		struct sock *sk = sock->sk;
		struct net *net = sock_net(sk);
		struct tipc_sock *tsk = tipc_sk(sk);
		struct tipc_nlist *dsts = tipc_group_dests(tsk->group);
		struct tipc_nlist *dsts;
		struct tipc_mc_method *method = &tsk->mc_method;
		bool ack = method->mandatory && method->rcast;
		int blks = tsk_blocks(MCAST_H_SIZE + dlen);
		@@ -1018,9 +1018,6 @@ static int tipc_send_group_bcast(struct socket sock, struct msghdr m,
		struct sk_buff_head pkts;
		int rc = -EHOSTUNREACH;

		if (!dsts->local && !dsts->remote)
		return -EHOSTUNREACH;

		/* Block or return if any destination link or member is congested */
		rc = tipc_wait_for_cond(sock, &timeout,
		!tsk->cong_link_cnt && tsk->group &&
		@@ -1028,6 +1025,10 @@ static int tipc_send_group_bcast(struct socket sock, struct msghdr m,
		if (unlikely(rc))
		return rc;

		dsts = tipc_group_dests(tsk->group);
		if (!dsts->local && !dsts->remote)
		return -EHOSTUNREACH;

		/* Complete message header */
		if (dest) {
		msg_set_type(hdr, TIPC_GRP_MCAST_MSG);

Admin message