From: Tommi Rantala <[email protected]>
Date: Wed, 29 Nov 2017 12:48:42 +0200
> Remove the second tipc_rcv() call in tipc_udp_recv(). We have just
> checked that the bearer is not up, and calling tipc_rcv() with a bearer
> that is not up leads to a TIPC div-by-zero crash in
> tipc_node_calculate_timer(). The crash is rare in practice, but can
> happen like this:
>
> We're enabling a bearer, but it's not yet up and fully initialized.
> At the same time we receive a discovery packet, and in tipc_udp_recv()
> we end up calling tipc_rcv() with the not-yet-initialized bearer,
> causing later the div-by-zero crash in tipc_node_calculate_timer().
>
> Jon Maloy explains the impact of removing the second tipc_rcv() call:
> "link setup in the worst case will be delayed until the next arriving
> discovery messages, 1 sec later, and this is an acceptable delay."
>
> As the tipc_rcv() call is removed, just leave the function via the
> rcu_out label, so that we will kfree_skb().
...
> Fixes: c9b64d492b1f ("tipc: add replicast peer discovery")
> Signed-off-by: Tommi Rantala <[email protected]>
> Cc: Jon Maloy <[email protected]>
Applied and queued up for -stable, thanks.
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
tipc-discussion mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tipc-discussion
