summaryrefslogtreecommitdiff
path: root/net/ipv6/udp_impl.h
diff options
context:
space:
mode:
authorJiri Pirko <jiri@resnulli.us>2013-05-09 08:23:40 +0400
committerDavid S. Miller <davem@davemloft.net>2013-05-12 03:25:00 +0400
commit233c7df0821c4190e2d3f4be0f2ca0ab40a5ed8c (patch)
tree3a384d69d266b382a700e87334cb6b40355511bd /net/ipv6/udp_impl.h
parentfb863b8beaf8121199c3dc32ab0126e8ce9cb34a (diff)
downloadlinux-233c7df0821c4190e2d3f4be0f2ca0ab40a5ed8c.tar.xz
macvlan: fix passthru mode race between dev removal and rx path
Currently, if macvlan in passthru mode is created and data are rxed and you remove this device, following panic happens: NULL pointer dereference at 0000000000000198 IP: [<ffffffffa0196058>] macvlan_handle_frame+0x153/0x1f7 [macvlan] I'm using following script to trigger this: <script> while [ 1 ] do ip link add link e1 name macvtap0 type macvtap mode passthru ip link set e1 up ip link set macvtap0 up IFINDEX=`ip link |grep macvtap0 | cut -f 1 -d ':'` cat /dev/tap$IFINDEX >/dev/null & ip link del dev macvtap0 done </script> I run this script while "ping -f" is running on another machine to send packets to e1 rx. Reason of the panic is that list_first_entry() is blindly called in macvlan_handle_frame() even if the list was empty. vlan is set to incorrect pointer which leads to the crash. I'm fixing this by protecting port->vlans list by rcu and by preventing from getting incorrect pointer in case the list is empty. Introduced by: commit eb06acdc85585f2 "macvlan: Introduce 'passthru' mode to takeover the underlying device" Signed-off-by: Jiri Pirko <jiri@resnulli.us> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/udp_impl.h')
0 files changed, 0 insertions, 0 deletions