Commit bcd326e8 authored by Allan Stephens's avatar Allan Stephens Committed by Paul Gortmaker
Browse files

tipc: Fix unsafe device list search when enabling bearer 



Ensures that the device list lock is held while trying to locate
the Ethernet device used by a newly enabled bearer, so that the
addition or removal of a device does not cause problems.

Signed-off-by: default avatarAllan Stephens <allan.stephens@windriver.com>
Signed-off-by: default avatarPaul Gortmaker <paul.gortmaker@windriver.com>
parent b4b56102

net/tipc/eth_media.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -2,7 +2,7 @@ 
 * net/tipc/eth_media.c: Ethernet bearer support for TIPC

 * net/tipc/eth_media.c: Ethernet bearer support for TIPC

 *

 *

 * Copyright (c) 2001-2007, Ericsson AB

 * Copyright (c) 2001-2007, Ericsson AB

 * Copyright (c) 2005-2007, Wind River Systems

 * Copyright (c) 2005-2008, 2011, Wind River Systems

 * All rights reserved.

 * All rights reserved.

 *

 *

 * Redistribution and use in source and binary forms, with or without

 * Redistribution and use in source and binary forms, with or without
@@ -144,12 +144,15 @@ static int enable_bearer(struct tipc_bearer *tb_ptr) 




	/* Find device with specified name */

	/* Find device with specified name */





	read_lock(&dev_base_lock);

	for_each_netdev(&init_net, pdev) {

	for_each_netdev(&init_net, pdev) {

		if (!strncmp(pdev->name, driver_name, IFNAMSIZ)) {

		if (!strncmp(pdev->name, driver_name, IFNAMSIZ)) {

			dev = pdev;

			dev = pdev;

			dev_hold(dev);

			break;

			break;

		}

		}

	}

	}

	read_unlock(&dev_base_lock);

	if (!dev)

	if (!dev)

		return -ENODEV;

		return -ENODEV;
@@ -166,7 +169,6 @@ static int enable_bearer(struct tipc_bearer *tb_ptr) 
		eb_ptr->tipc_packet_type.func = recv_msg;

		eb_ptr->tipc_packet_type.func = recv_msg;

		eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr;

		eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr;

		INIT_LIST_HEAD(&(eb_ptr->tipc_packet_type.list));

		INIT_LIST_HEAD(&(eb_ptr->tipc_packet_type.list));

		dev_hold(dev);

		dev_add_pack(&eb_ptr->tipc_packet_type);

		dev_add_pack(&eb_ptr->tipc_packet_type);

	}

	}