Commit 453acbe7 authored by Xin Long's avatar Xin Long Committed by Liu Jian
Browse files

tipc: remove ub->ubsock checks 

mainline inclusion
from mainline-v5.3-rc1
commit d2c3a4ba
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPI
CVE: CVE-2024-56642

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d2c3a4ba25fbfb6b2c7b5fe423be1b287954cd4c



-------------------------------------------------

Both tipc_udp_enable and tipc_udp_disable are called under rtnl_lock,
ub->ubsock could never be NULL in tipc_udp_disable and cleanup_bearer,
so remove the check.

Also remove the one in tipc_udp_enable by adding "free" label.

Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>

Conflicts:
	net/tipc/udp_media.c
[Did not backport e9c1a793.]
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent d724510e

net/tipc/udp_media.c

+5 −7
Original line number Diff line number Diff line
@@ -753,12 +753,12 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b, 
	else

		err = tipc_udp_rcast_add(b, &remote);

	if (err)

		goto err;

		goto free;



	return 0;

err:

	if (ub->ubsock)

free:

	udp_tunnel_sock_release(ub->ubsock);

err:

	kfree(ub);

	return err;

}
@@ -775,7 +775,6 @@ static void cleanup_bearer(struct work_struct *work) 
	}



	atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);

	if (ub->ubsock)

	udp_tunnel_sock_release(ub->ubsock);

	synchronize_net();

	kfree(ub);
@@ -791,7 +790,6 @@ static void tipc_udp_disable(struct tipc_bearer *b) 
		pr_err("UDP bearer instance not found\n");

		return;

	}

	if (ub->ubsock)

	sock_set_flag(ub->ubsock->sk, SOCK_DEAD);

	RCU_INIT_POINTER(ub->bearer, NULL);