tipc: fix access of released memory

When the function tipc_group_filter_msg() finds that a member event
indicates that the member is leaving the group, it first deletes the
member instance, and then purges the message queue being handled
by the call. But the message queue is an aggregated field in the
just deleted item, leading the purge call to access freed memory.

We fix this by swapping the order of the two actions.

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/tipc/group.c b/net/tipc/group.c
index 7821085a7dd87cb81b1b5e3f5c4d33273c65e3d9..12777cac638a6918a626953647a1bf803ced89ad 100644 (file)
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -539,8 +539,8 @@ void tipc_group_filter_msg(struct tipc_group *grp, struct sk_buff_head *inputq,
                        tipc_group_proto_xmit(grp, m, GRP_ACK_MSG, xmitq);
 
                if (leave) {
-                       tipc_group_delete_member(grp, m);
                        __skb_queue_purge(defq);
+                       tipc_group_delete_member(grp, m);
                        break;
                }
                if (!update)