diff options
| author | Jiri Pirko <jiri@resnulli.us> | 2013-06-08 15:00:53 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-06-27 11:27:32 -0700 |
| commit | a50ebefd35d237b3a6112e5fbea6d55e7ae4b509 (patch) | |
| tree | d0c0d514faa7cab48a4cc53076e2e5acc0ed9a53 | |
| parent | 93f75344976da9eb5f411312d2d46d37d9223fd2 (diff) | |
team: check return value of team_get_port_by_index_rcu() for NULL
[ Upstream commit 76c455decbbad31de21c727edb184a963f42b40b ]
team_get_port_by_index_rcu() might return NULL due to race between port
removal and skb tx path. Panic is easily triggeable when txing packets
and adding/removing port in a loop.
introduced by commit 3d249d4ca "net: introduce ethernet teaming device"
and commit 753f993911b "team: introduce random mode" (for random mode)
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/team/team_mode_roundrobin.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/team/team_mode_roundrobin.c b/drivers/net/team/team_mode_roundrobin.c index a0e8f806331a..bf6a818c3d03 100644 --- a/drivers/net/team/team_mode_roundrobin.c +++ b/drivers/net/team/team_mode_roundrobin.c @@ -52,6 +52,8 @@ static bool rr_transmit(struct team *team, struct sk_buff *skb) port_index = rr_priv(team)->sent_packets++ % team->port_count; port = team_get_port_by_index_rcu(team, port_index); + if (unlikely(!port)) + goto drop; port = __get_first_port_up(team, port); if (unlikely(!port)) goto drop; |