summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJon Maloy <jon.maloy@ericsson.com>2017-11-20 21:43:03 +0100
committerDavid S. Miller <davem@davemloft.net>2017-11-21 20:22:03 +0900
commite0e853ac036f76fcad3995554b8b6cef555b010f (patch)
treeac0cfcd42e7fa2a9712c57e4e8caf36ca6e8e6bc /net
parentf9409e7f086fa6c4623769b4b2f4f17a024d8143 (diff)
downloadop-kernel-dev-e0e853ac036f76fcad3995554b8b6cef555b010f.zip
op-kernel-dev-e0e853ac036f76fcad3995554b8b6cef555b010f.tar.gz
tipc: fix access of released memory
When the function tipc_group_filter_msg() finds that a member event indicates that the member is leaving the group, it first deletes the member instance, and then purges the message queue being handled by the call. But the message queue is an aggregated field in the just deleted item, leading the purge call to access freed memory. We fix this by swapping the order of the two actions. Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/tipc/group.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 7821085..12777ca 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -539,8 +539,8 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
tipc_group_proto_xmit(grp, m, GRP_ACK_MSG, xmitq);
if (leave) {
- tipc_group_delete_member(grp, m);
__skb_queue_purge(defq);
+ tipc_group_delete_member(grp, m);
break;
}
if (!update)
OpenPOWER on IntegriCloud