| Message ID | 20120430102256.GA32587@gondor.apana.org.au |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Mon, 30 Apr 2012 20:22:56 +1000 Herbert Xu <herbert@gondor.apana.org.au> wrote: > Unfortunately it seems that I didn't properly test the case of > an expired external querier in the recent multicast bridge series. > > The setup of the timer in that case is completely broken and leads > to a NULL-pointer dereference. This patch fixes it. > > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Acked-by: Stephen Hemminger <shemminger@vyatta.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Herbert Xu <herbert@gondor.hengli.com.au> Date: Mon, 30 Apr 2012 20:22:56 +1000 > Unfortunately it seems that I didn't properly test the case of > an expired external querier in the recent multicast bridge series. > > The setup of the timer in that case is completely broken and leads > to a NULL-pointer dereference. This patch fixes it. > > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> ... > - br_multicast_querier_expired, 0); > + br_multicast_querier_expired, (unsigned long)br); > setup_timer(&br->multicast_query_timer, br_multicast_query_expired, > (unsigned long)br); > } > > Sorry for the screw-up. Please do not put comments after the patch, this made the second hunk reject when I pulled it out of patchwork. Anyways, fixed up and applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index 26df642..b320871 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -744,8 +744,7 @@ static void br_multicast_local_router_expired(unsigned long data) static void br_multicast_querier_expired(unsigned long data) { - struct net_bridge_port *port = (void *)data; - struct net_bridge *br = port->br; + struct net_bridge *br = (void *)data; spin_lock(&br->multicast_lock); if (!netif_running(br->dev) || br->multicast_disabled) @@ -1581,7 +1580,7 @@ void br_multicast_init(struct net_bridge *br) setup_timer(&br->multicast_router_timer, br_multicast_local_router_expired, 0); setup_timer(&br->multicast_querier_timer, - br_multicast_querier_expired, 0); + br_multicast_querier_expired, (unsigned long)br); setup_timer(&br->multicast_query_timer, br_multicast_query_expired, (unsigned long)br); }
Unfortunately it seems that I didn't properly test the case of an expired external querier in the recent multicast bridge series. The setup of the timer in that case is completely broken and leads to a NULL-pointer dereference. This patch fixes it. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Sorry for the screw-up.