tipc: add NULL pointer check to prevent kernel oops (746a1eda) · Commits · 戴 / test

Calling: tipc_node_link_down()-> - tipc_node_write_unlock()->tipc_mon_peer_down() - tipc_mon_peer_down() just after disabling bearer could be caused kernel oops. Fix this by adding a sanity check to make sure valid memory access. Acked-by:

Jon Maloy <jmaloy@redhat.com> Signed-off-by:

Hoang Le <hoang.h.le@dektech.com.au> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/tipc/monitor.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -322,9 +322,13 @@ static void mon_assign_roles(struct tipc_monitor mon, struct tipc_peer head)
		void tipc_mon_remove_peer(struct net *net, u32 addr, int bearer_id)
		{
		struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
		struct tipc_peer *self = get_self(net, bearer_id);
		struct tipc_peer *self;
		struct tipc_peer peer, prev, *head;

		if (!mon)
		return;

		self = get_self(net, bearer_id);
		write_lock_bh(&mon->lock);
		peer = get_peer(mon, addr);
		if (!peer)
		@@ -407,11 +411,15 @@ exit:
		void tipc_mon_peer_down(struct net *net, u32 addr, int bearer_id)
		{
		struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
		struct tipc_peer *self = get_self(net, bearer_id);
		struct tipc_peer *self;
		struct tipc_peer peer, head;
		struct tipc_mon_domain *dom;
		int applied;

		if (!mon)
		return;

		self = get_self(net, bearer_id);
		write_lock_bh(&mon->lock);
		peer = get_peer(mon, addr);
		if (!peer) {

Admin message