Commit e0e853ac authored Nov 20, 2017 by Jon Maloy Committed by David S. Miller Nov 21, 2017

tipc: fix access of released memory



When the function tipc_group_filter_msg() finds that a member event
indicates that the member is leaving the group, it first deletes the
member instance, and then purges the message queue being handled
by the call. But the message queue is an aggregated field in the
just deleted item, leading the purge call to access freed memory.

We fix this by swapping the order of the two actions.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f9409e7f

net/tipc/group.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -539,8 +539,8 @@ void tipc_group_filter_msg(struct tipc_group grp, struct sk_buff_head inputq,
		tipc_group_proto_xmit(grp, m, GRP_ACK_MSG, xmitq);

		if (leave) {
		tipc_group_delete_member(grp, m);
		__skb_queue_purge(defq);
		tipc_group_delete_member(grp, m);
		break;
		}
		if (!update)

Admin message