Unverified Commit 61d3ea9d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3038 ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhengchao Shao <shaozhengchao@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/2VUNIADSAK5MFSSHSYMDQ2PTEAMGRTWT/ 
 
https://gitee.com/openeuler/kernel/issues/I8K0N2 
 
Link:https://gitee.com/openeuler/kernel/pulls/3038

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 8cf0ad32 bc3e8b88

net/ipv4/igmp.c

+4 −2
Original line number Diff line number Diff line
@@ -221,8 +221,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) 
	int tv = prandom_u32() % max_delay;



	im->tm_running = 1;

	if (!mod_timer(&im->timer, jiffies+tv+2))

		refcount_inc(&im->refcnt);

	if (refcount_inc_not_zero(&im->refcnt)) {

		if (mod_timer(&im->timer, jiffies + tv + 2))

			ip_ma_put(im);

	}

}



static void igmp_gq_start_timer(struct in_device *in_dev)