diff mbox

[3.8.y.z,extended,stable] Patch "team: check return value of team_get_port_by_index_rcu() for NULL" has been added to staging queue

Message ID 1372198814-20229-1-git-send-email-kamal@canonical.com
State New
Headers show

Commit Message

Kamal Mostafa June 25, 2013, 10:20 p.m. UTC 
This is a note to let you know that I have just added a patch titled

    team: check return value of team_get_port_by_index_rcu() for NULL

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.4.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

From 8736dde17ffff922959aba90102169f995e827ec Mon Sep 17 00:00:00 2001
From: Jiri Pirko <jiri@resnulli.us>
Date: Sat, 8 Jun 2013 15:00:53 +0200
Subject: team: check return value of team_get_port_by_index_rcu() for NULL

[ Upstream commit 76c455decbbad31de21c727edb184a963f42b40b ]

team_get_port_by_index_rcu() might return NULL due to race between port
removal and skb tx path. Panic is easily triggeable when txing packets
and adding/removing port in a loop.

introduced by commit 3d249d4ca "net: introduce ethernet teaming device"
and commit 753f993911b "team: introduce random mode" (for random mode)

Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/team/team_mode_roundrobin.c | 2 ++
 1 file changed, 2 insertions(+)

--
1.8.1.2
diff mbox

Patch

diff --git a/drivers/net/team/team_mode_roundrobin.c b/drivers/net/team/team_mode_roundrobin.c
index 105135a..041cc0a 100644
--- a/drivers/net/team/team_mode_roundrobin.c
+++ b/drivers/net/team/team_mode_roundrobin.c
@@ -52,6 +52,8 @@  static bool rr_transmit(struct team *team, struct sk_buff *skb)

 	port_index = rr_priv(team)->sent_packets++ % team->en_port_count;
 	port = team_get_port_by_index_rcu(team, port_index);
+	if (unlikely(!port))
+		goto drop;
 	port = __get_first_port_up(team, port);
 	if (unlikely(!port))
 		goto drop;