i40iw: Receive netdev events post INET_NOTIFIER state
Netdev notification events are de-registered only when all client iwdev instances are removed. If a single client is closed and re-opened, netdev events could arrive even before the Control Queue-Pair (CQP) is created, causing a NULL pointer dereference crash in i40iw_get_cqp_request. Fix this by allowing netdev event notification only after we have reached the INET_NOTIFIER state with respect to device initialization. Reported-by: Stefan Assmann <sassmann@redhat.com> Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com> Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
This commit is contained in:
parent
97da3854c5
commit
871a8623d3
|
@ -160,6 +160,9 @@ int i40iw_inetaddr_event(struct notifier_block *notifier,
|
|||
return NOTIFY_DONE;
|
||||
|
||||
iwdev = &hdl->device;
|
||||
if (iwdev->init_state < INET_NOTIFIER)
|
||||
return NOTIFY_DONE;
|
||||
|
||||
netdev = iwdev->ldev->netdev;
|
||||
upper_dev = netdev_master_upper_dev_get(netdev);
|
||||
if (netdev != event_netdev)
|
||||
|
@ -214,6 +217,9 @@ int i40iw_inet6addr_event(struct notifier_block *notifier,
|
|||
return NOTIFY_DONE;
|
||||
|
||||
iwdev = &hdl->device;
|
||||
if (iwdev->init_state < INET_NOTIFIER)
|
||||
return NOTIFY_DONE;
|
||||
|
||||
netdev = iwdev->ldev->netdev;
|
||||
if (netdev != event_netdev)
|
||||
return NOTIFY_DONE;
|
||||
|
@ -260,6 +266,8 @@ int i40iw_net_event(struct notifier_block *notifier, unsigned long event, void *
|
|||
if (!iwhdl)
|
||||
return NOTIFY_DONE;
|
||||
iwdev = &iwhdl->device;
|
||||
if (iwdev->init_state < INET_NOTIFIER)
|
||||
return NOTIFY_DONE;
|
||||
p = (__be32 *)neigh->primary_key;
|
||||
i40iw_copy_ip_ntohl(local_ipaddr, p);
|
||||
if (neigh->nud_state & NUD_VALID) {
|
||||
|
|
Loading…
Reference in New Issue