forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

i40iw: Avoid panic when handling the inetdev event

Browse source 
[ Upstream commit ec4fe4bcc5 ]

There is a panic reported that on a system with x722 ethernet, when doing
the operations like:

	# ip link add br0 type bridge
	# ip link set eno1 master br0
	# systemctl restart systemd-networkd

The system will panic "BUG: unable to handle kernel null pointer
dereference at 0000000000000034", with call chain:

	i40iw_inetaddr_event
	notifier_call_chain
	blocking_notifier_call_chain
	notifier_call_chain
	__inet_del_ifa
	inet_rtm_deladdr
	rtnetlink_rcv_msg
	netlink_rcv_skb
	rtnetlink_rcv
	netlink_unicast
	netlink_sendmsg
	sock_sendmsg
	__sys_sendto

It is caused by "local_ipaddr = ntohl(in->ifa_list->ifa_address)", while
the in->ifa_list is NULL.

So add a check for the "in->ifa_list == NULL" case, and skip the ARP
operation accordingly.

Signed-off-by: Feng Tang <feng.tang@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Feng Tang 2019-03-14 18:37:29 +08:00 • committed by Greg Kroah-Hartman
commit f596ad9ea8
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
drivers/infiniband/hw/i40iw/i40iw_utils.c
View file

@ -173,7 +173,12 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
rcu_read_lock();
in = __in_dev_get_rcu(upper_dev);
local_ipaddr = ntohl(in->ifa_list->ifa_address);
if (!in->ifa_list)
local_ipaddr = 0;
else
local_ipaddr = ntohl(in->ifa_list->ifa_address);
rcu_read_unlock();
} else {
local_ipaddr = ntohl(ifa->ifa_address);
@ -185,6 +190,11 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
case NETDEV_UP:
/* Fall through */
case NETDEV_CHANGEADDR:
/* Just skip if no need to handle ARP cache */
if (!local_ipaddr)
break;
i40iw_manage_arp_cache(iwdev,
netdev->dev_addr,
&local_ipaddr,