iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cnic: Fix panic in cnic_iscsi_nl_msg_recv() when device is down.

Browse Source 
Some data structures are freed when the device is down and it will
crash if an ISCSI netlink message is received.  Add RCU protection
to prevent this.  In the shutdown path, ulp_ops[CNIC_ULP_L4] is
assigned NULL and rcu_synchronized before freeing the data
structures.

Signed-off-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Michael Chan 2010-02-24 14:42:06 +00:00 committed by David S. Miller
parent 66883e90ea
commit d02a5e6c2f
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/net/cnic.c
View File

@ -327,6 +327,12 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
if (l5_cid >= MAX_CM_SK_TBL_SZ) if (l5_cid >= MAX_CM_SK_TBL_SZ)
break; break;
rcu_read_lock();
if (!rcu_dereference(cp->ulp_ops[CNIC_ULP_L4])) {
rc = -ENODEV;
rcu_read_unlock();
break;
}
csk = &cp->csk_tbl[l5_cid]; csk = &cp->csk_tbl[l5_cid];
csk_hold(csk); csk_hold(csk);
if (cnic_in_use(csk)) { if (cnic_in_use(csk)) {
@ -341,6 +347,7 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
cnic_cm_set_pg(csk); cnic_cm_set_pg(csk);
} }
csk_put(csk); csk_put(csk);
rcu_read_unlock();
rc = 0; rc = 0;
} }
} }