Commit d02a5e6c authored by Michael Chan's avatar Michael Chan Committed by David S. Miller

cnic: Fix panic in cnic_iscsi_nl_msg_recv() when device is down.

Some data structures are freed when the device is down and it will
crash if an ISCSI netlink message is received.  Add RCU protection
to prevent this.  In the shutdown path, ulp_ops[CNIC_ULP_L4] is
assigned NULL and rcu_synchronized before freeing the data
structures.
Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 66883e90
...@@ -327,6 +327,12 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type, ...@@ -327,6 +327,12 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
if (l5_cid >= MAX_CM_SK_TBL_SZ) if (l5_cid >= MAX_CM_SK_TBL_SZ)
break; break;
rcu_read_lock();
if (!rcu_dereference(cp->ulp_ops[CNIC_ULP_L4])) {
rc = -ENODEV;
rcu_read_unlock();
break;
}
csk = &cp->csk_tbl[l5_cid]; csk = &cp->csk_tbl[l5_cid];
csk_hold(csk); csk_hold(csk);
if (cnic_in_use(csk)) { if (cnic_in_use(csk)) {
...@@ -341,6 +347,7 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type, ...@@ -341,6 +347,7 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
cnic_cm_set_pg(csk); cnic_cm_set_pg(csk);
} }
csk_put(csk); csk_put(csk);
rcu_read_unlock();
rc = 0; rc = 0;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment