Message ID | 20200611100808.24244-1-tuong.t.lien@dektech.com.au |
---|---|
State | Accepted |
Delegated to: | David Miller |
Headers | show |
Series | [net] tipc: fix NULL pointer dereference in tipc_disc_rcv() | expand |
From: Tuong Lien <tuong.t.lien@dektech.com.au> Date: Thu, 11 Jun 2020 17:08:08 +0700 > When a bearer is enabled, we create a 'tipc_discoverer' object to store > the bearer related data along with a timer and a preformatted discovery > message buffer for later probing... However, this is only carried after > the bearer was set 'up', that left a race condition resulting in kernel > panic. > > It occurs when a discovery message from a peer node is received and > processed in bottom half (since the bearer is 'up' already) just before > the discoverer object is created but is now accessed in order to update > the preformatted buffer (with a new trial address, ...) so leads to the > NULL pointer dereference. > > We solve the problem by simply moving the bearer 'up' setting to later, > so make sure everything is ready prior to any message receiving. > > Acked-by: Jon Maloy <jmaloy@redhat.com> > Signed-off-by: Tuong Lien <tuong.t.lien@dektech.com.au> Applied, thanks.
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c index 34ca7b789eba..e366ec9a7e4d 100644 --- a/net/tipc/bearer.c +++ b/net/tipc/bearer.c @@ -316,7 +316,6 @@ static int tipc_enable_bearer(struct net *net, const char *name, b->domain = disc_domain; b->net_plane = bearer_id + 'A'; b->priority = prio; - test_and_set_bit_lock(0, &b->up); refcount_set(&b->refcnt, 1); res = tipc_disc_create(net, b, &b->bcast_addr, &skb); @@ -326,6 +325,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, goto rejected; } + test_and_set_bit_lock(0, &b->up); rcu_assign_pointer(tn->bearer_list[bearer_id], b); if (skb) tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);