Commit 746a1eda authored by Hoang Le's avatar Hoang Le Committed by David S. Miller

tipc: add NULL pointer check to prevent kernel oops

Calling:
tipc_node_link_down()->
   - tipc_node_write_unlock()->tipc_mon_peer_down()
   - tipc_mon_peer_down()
  just after disabling bearer could be caused kernel oops.

Fix this by adding a sanity check to make sure valid memory
access.
Acked-by: default avatarJon Maloy <jmaloy@redhat.com>
Signed-off-by: default avatarHoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e228c5c0
...@@ -322,9 +322,13 @@ static void mon_assign_roles(struct tipc_monitor *mon, struct tipc_peer *head) ...@@ -322,9 +322,13 @@ static void mon_assign_roles(struct tipc_monitor *mon, struct tipc_peer *head)
void tipc_mon_remove_peer(struct net *net, u32 addr, int bearer_id) void tipc_mon_remove_peer(struct net *net, u32 addr, int bearer_id)
{ {
struct tipc_monitor *mon = tipc_monitor(net, bearer_id); struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
struct tipc_peer *self = get_self(net, bearer_id); struct tipc_peer *self;
struct tipc_peer *peer, *prev, *head; struct tipc_peer *peer, *prev, *head;
if (!mon)
return;
self = get_self(net, bearer_id);
write_lock_bh(&mon->lock); write_lock_bh(&mon->lock);
peer = get_peer(mon, addr); peer = get_peer(mon, addr);
if (!peer) if (!peer)
...@@ -407,11 +411,15 @@ void tipc_mon_peer_up(struct net *net, u32 addr, int bearer_id) ...@@ -407,11 +411,15 @@ void tipc_mon_peer_up(struct net *net, u32 addr, int bearer_id)
void tipc_mon_peer_down(struct net *net, u32 addr, int bearer_id) void tipc_mon_peer_down(struct net *net, u32 addr, int bearer_id)
{ {
struct tipc_monitor *mon = tipc_monitor(net, bearer_id); struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
struct tipc_peer *self = get_self(net, bearer_id); struct tipc_peer *self;
struct tipc_peer *peer, *head; struct tipc_peer *peer, *head;
struct tipc_mon_domain *dom; struct tipc_mon_domain *dom;
int applied; int applied;
if (!mon)
return;
self = get_self(net, bearer_id);
write_lock_bh(&mon->lock); write_lock_bh(&mon->lock);
peer = get_peer(mon, addr); peer = get_peer(mon, addr);
if (!peer) { if (!peer) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment