Commit 97982782 authored by Tuong Lien's avatar Tuong Lien Committed by David S. Miller

tipc: fix NULL pointer dereference in tipc_disc_rcv()

When a bearer is enabled, we create a 'tipc_discoverer' object to store
the bearer related data along with a timer and a preformatted discovery
message buffer for later probing... However, this is only carried after
the bearer was set 'up', that left a race condition resulting in kernel
panic.

It occurs when a discovery message from a peer node is received and
processed in bottom half (since the bearer is 'up' already) just before
the discoverer object is created but is now accessed in order to update
the preformatted buffer (with a new trial address, ...) so leads to the
NULL pointer dereference.

We solve the problem by simply moving the bearer 'up' setting to later,
so make sure everything is ready prior to any message receiving.
Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
Signed-off-by: default avatarTuong Lien <tuong.t.lien@dektech.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c9aa81fa
...@@ -316,7 +316,6 @@ static int tipc_enable_bearer(struct net *net, const char *name, ...@@ -316,7 +316,6 @@ static int tipc_enable_bearer(struct net *net, const char *name,
b->domain = disc_domain; b->domain = disc_domain;
b->net_plane = bearer_id + 'A'; b->net_plane = bearer_id + 'A';
b->priority = prio; b->priority = prio;
test_and_set_bit_lock(0, &b->up);
refcount_set(&b->refcnt, 1); refcount_set(&b->refcnt, 1);
res = tipc_disc_create(net, b, &b->bcast_addr, &skb); res = tipc_disc_create(net, b, &b->bcast_addr, &skb);
...@@ -326,6 +325,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, ...@@ -326,6 +325,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
goto rejected; goto rejected;
} }
test_and_set_bit_lock(0, &b->up);
rcu_assign_pointer(tn->bearer_list[bearer_id], b); rcu_assign_pointer(tn->bearer_list[bearer_id], b);
if (skb) if (skb)
tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr); tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment