Subject: [PATCH net] tipc: make sure bc_rcvlink is not dereferenced with NULL
value

From: Gleb Markov <redacted>

The direct dependence of the tipc_link_is_up() value on l->bc_rcvlink is not
explicitly specified.

If link is up, it is assumed that the sender and receiver have valid values
(communication with the receiver is required for timeout synchronization),
which is not guaranteed in this code segment.

Turning independent conditions into nested conditions ensures that NULL
cannot be dereferenced at tipc_link_build_proto_msg() and allows for the
logical structure to be fixed at the functional interaction level.

Make tipc_link_build_proto_msg() call only if l->bc_rcvlink is not NULL.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 047491ea334a ("tipc: set link tolerance correctly in broadcast link")
Signed-off-by: Gleb Markov <redacted>
---
net/tipc/link.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c index 49dfc098d89b..b0a640c419c8

100644

--- a/net/tipc/link.c
+++ b/net/tipc/link.c

@@ -2863,10 +2863,12 @@ void tipc_link_set_tolerance(struct tipc_link *l,

u32 tol,
			     struct sk_buff_head *xmitq)
{
	l->tolerance = tol;
-	if (l->bc_rcvlink)
+	if (l->bc_rcvlink) {
		l->bc_rcvlink->tolerance = tol;
-	if (tipc_link_is_up(l))
-		tipc_link_build_proto_msg(l, STATE_MSG, 0, 0, 0, tol, 0, xmitq);
+		if (tipc_link_is_up(l))
+			tipc_link_build_proto_msg(l, STATE_MSG,
+						  0, 0, 0, tol, 0, xmitq);
+	}