From: Tommi Rantala <tommi.t.rant...@nokia.com>
Date: Wed, 29 Nov 2017 12:48:42 +0200
> Remove the second tipc_rcv() call in tipc_udp_recv(). We have just
> checked that the bearer is not up, and calling tipc_rcv() with a bearer
> that is not up leads to a TIPC div-by-zero crash in
> tipc_node_calculate_timer(). The crash is rare in practice, but can
> happen like this:
>
> We're enabling a bearer, but it's not yet up and fully initialized.
> At the same time we receive a discovery packet, and in tipc_udp_recv()
> we end up calling tipc_rcv() with the not-yet-initialized bearer,
> causing later the div-by-zero crash in tipc_node_calculate_timer().
>
> Jon Maloy explains the impact of removing the second tipc_rcv() call:
> "link setup in the worst case will be delayed until the next arriving
> discovery messages, 1 sec later, and this is an acceptable delay."
>
> As the tipc_rcv() call is removed, just leave the function via the
> rcu_out label, so that we will kfree_skb().
...
> Fixes: c9b64d492b1f ("tipc: add replicast peer discovery")
> Signed-off-by: Tommi Rantala <tommi.t.rant...@nokia.com>
> Cc: Jon Maloy <jon.ma...@ericsson.com>
Applied and queued up for -stable, thanks.
