TIPC group broadcast senders are blocked in poll()/write() until all members have acked the replicast. When a departing member held the last outstanding ack, tipc_group_delete_member() decrements grp->bc_ackers to zero but never restores *grp->open nor wakes the blocked senders; write() then sleeps until the send timeout and poll() is never woken at all. Commit 99cc2a62e07a ("tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow") noted this as a pre-existing issue. Restore the open state exactly on the 1->0 acker transition in the delete path, mirroring the GRP_ACK_MSG completion path, and invoke sk->sk_write_space() from tipc_sk_filter_rcv() when the group just became writable again. This vulnerability was discovered by Tencent CodeBuddy Security. Cc: stable@vger.kernel.org Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Signed-off-by: Henry Martin --- net/tipc/group.c | 9 ++++++--- net/tipc/socket.c | 12 +++++++++++- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index 74f6d3dac0784..e20eb612f82ce 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -340,9 +340,12 @@ static void tipc_group_delete_member(struct tipc_group *grp, rb_erase(&m->tree_node, &grp->members); grp->member_cnt--; - /* Check if we were waiting for replicast ack from this member */ - if (grp->bc_ackers && less(m->bc_acked, grp->bc_snd_nxt - 1)) - grp->bc_ackers--; + /* If this member held the last outstanding replicast ack, + * restore the open state so blocked broadcast senders can proceed. + */ + if (grp->bc_ackers && less(m->bc_acked, grp->bc_snd_nxt - 1) && + !--grp->bc_ackers) + *grp->open = true; list_del_init(&m->list); list_del_init(&m->small_win); diff --git a/net/tipc/socket.c b/net/tipc/socket.c index d5d70eb230b56..65cc0c4964b31 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -2356,8 +2356,18 @@ static void tipc_sk_filter_rcv(struct sock *sk, struct sk_buff *skb, if (unlikely(!msg_isdata(hdr))) tipc_sk_proto_rcv(sk, &inputq, xmitq); - if (unlikely(grp)) + if (unlikely(grp)) { + bool was_open = tsk->group_is_open; + tipc_group_filter_msg(grp, &inputq, xmitq); + /* A departing member may have held the last outstanding + * replicast ack, which can restore the open state inside + * tipc_group_filter_msg(); wake up senders blocked in + * poll()/write() if the group just became writable. + */ + if (!was_open && tsk->group_is_open) + sk->sk_write_space(sk); + } if (unlikely(!grp) && mtyp == TIPC_MCAST_MSG) tipc_mcast_filter_msg(net, &tsk->mc_method.deferredq, &inputq); -- 2.43.7