Unverified Commit 3b063171 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3626 ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/M33E2UNUWMX2XNP5RWGJSDHXX5XHDELX/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8PT5 
 
Link:https://gitee.com/openeuler/kernel/pulls/3626

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents a9e6f4ba 92e7f325

net/ipv4/igmp.c

+4 −2
Original line number Diff line number Diff line
@@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) 
	int tv = prandom_u32() % max_delay;



	im->tm_running = 1;

	if (!mod_timer(&im->timer, jiffies+tv+2))

		refcount_inc(&im->refcnt);

	if (refcount_inc_not_zero(&im->refcnt)) {

		if (mod_timer(&im->timer, jiffies + tv + 2))

			ip_ma_put(im);

	}

}



static void igmp_gq_start_timer(struct in_device *in_dev)