From patchwork Mon Mar 4 03:36:57 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amerigo Wang X-Patchwork-Id: 224579 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id F20232C02CD for ; Mon, 4 Mar 2013 14:37:29 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755155Ab3CDDhY (ORCPT ); Sun, 3 Mar 2013 22:37:24 -0500 Received: from mx1.redhat.com ([209.132.183.28]:32567 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755151Ab3CDDhX (ORCPT ); Sun, 3 Mar 2013 22:37:23 -0500 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r243bGuM027937 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 3 Mar 2013 22:37:16 -0500 Received: from cr0.redhat.com (vpn1-112-185.nay.redhat.com [10.66.112.185]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r243b8Es017292; Sun, 3 Mar 2013 22:37:10 -0500 From: Cong Wang To: netdev@vger.kernel.org Cc: bugs@syam.in, David Ward , Stephen Hemminger , "David S. Miller" , Cong Wang Subject: [Patch net] garp: fix a NULL pointer dereference bug Date: Mon, 4 Mar 2013 11:36:57 +0800 Message-Id: <1362368217-30984-1-git-send-email-amwang@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.25 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Cong Wang A NULL-deref bug was reported in: https://bugzilla.kernel.org/show_bug.cgi?id=54281 when deleting a vlan interface: # ip link del em1.57 BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] garp_uninit_applicant+0x2f/0xd0 [garp] ... This is probably app->pdu is NULL'ed in garp_pdu_rcv() in BH, while garp_uninit_applicant() only holds rtnl lock which is not enough to prevent this. OTOH, garp_pdu_queue() should ways be called with the spin lock. Reported-by: bugs@syam.in Cc: bugs@syam.in Cc: David Ward Cc: Stephen Hemminger Cc: David S. Miller Signed-off-by: Cong Wang --- -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/802/garp.c b/net/802/garp.c index 8456f5d..5d9630a 100644 --- a/net/802/garp.c +++ b/net/802/garp.c @@ -609,8 +609,12 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl /* Delete timer and generate a final TRANSMIT_PDU event to flush out * all pending messages before the applicant is gone. */ del_timer_sync(&app->join_timer); + + spin_lock_bh(&app->lock); garp_gid_event(app, GARP_EVENT_TRANSMIT_PDU); garp_pdu_queue(app); + spin_unlock_bh(&app->lock); + garp_queue_xmit(app); dev_mc_del(dev, appl->proto.group_address);