Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

team: check return value of team_get_port_by_index_rcu() for NULL

team_get_port_by_index_rcu() might return NULL due to race between port
removal and skb tx path. Panic is easily triggeable when txing packets
and adding/removing port in a loop.

introduced by commit 3d249d4ca "net: introduce ethernet teaming device"
and commit 753f993911b "team: introduce random mode" (for random mode)

Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Jiri Pirko and committed by
David S. Miller
76c455de 19a6afb2

+4
+2
drivers/net/team/team_mode_random.c
··· 28 28 29 29 port_index = random_N(team->en_port_count); 30 30 port = team_get_port_by_index_rcu(team, port_index); 31 + if (unlikely(!port)) 32 + goto drop; 31 33 port = team_get_first_port_txable_rcu(team, port); 32 34 if (unlikely(!port)) 33 35 goto drop;
+2
drivers/net/team/team_mode_roundrobin.c
··· 32 32 33 33 port_index = rr_priv(team)->sent_packets++ % team->en_port_count; 34 34 port = team_get_port_by_index_rcu(team, port_index); 35 + if (unlikely(!port)) 36 + goto drop; 35 37 port = team_get_first_port_txable_rcu(team, port); 36 38 if (unlikely(!port)) 37 39 goto drop;